Hi, Nunpad
This is the ComboFix Report :
ComboFix 13-02-03.03 - Tinel 02/06/2013 0:37.1.1 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.789 [GMT 2:00]
Running from: c:\documents and settings\Tinel\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\1359054109.bdinstall.bin
c:\documents and settings\All Users\Application Data\1359152412.bdinstall.bin
c:\documents and settings\All Users\Application Data\1359199325.bdinstall.bin
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\Tinel\Application Data\HPSU_48BitScanUpdate.log
C:\Documents
c:\windows\system32\bn.dll
c:\windows\system32\dllcache\wmpvis.dll
c:\windows\system32\drivers\npf.sys
c:\windows\system32\office.exe
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\tempdir
c:\windows\system32\tempdir\tinypdf.chm
c:\windows\system32\tempdir\tinypdf.dll
c:\windows\system32\tempdir\tinypdf1.dll
c:\windows\system32\tempdir\tinypdf2.dll
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\msvcr71.dll.001
c:\windows\system32\URTTemp\msvcr71.dll.int
c:\windows\system32\URTTemp\regtlib.exe
c:\windows\system32\wpcap.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_AFPANSI
-------\Legacy_NPF
-------\Service_AFPAnsi
-------\Service_npf
-------\Legacy_Skype_C2C_Service
-------\Legacy_SMR311
-------\Legacy_SMR311
-------\Legacy_SMR311
-------\Legacy_SMR311
-------\Service_Skype C2C Service
-------\Service_SMR311
-------\Service_SMR311
-------\Service_SMR311
-------\Service_SMR311
.
.
((((((((((((((((((((((((( Files Created from 2013-01-05 to 2013-02-05 )))))))))))))))))))))))))))))))
.
.
2013-02-05 19:01 . 2013-02-05 19:01 -------- d-----w- c:\documents and settings\Tinel\Application Data\AVG2013
2013-02-05 18:59 . 2013-02-05 18:59 -------- d-----w- c:\documents and settings\Tinel\Local Settings\Application Data\AVG Secure Search
2013-02-05 18:59 . 2013-02-05 18:59 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Secure Search
2013-02-05 18:59 . 2013-02-05 18:59 -------- d-----w- c:\documents and settings\Tinel\Application Data\AVG Secure Search
2013-02-05 18:59 . 2013-02-05 18:59 26984 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
2013-02-05 18:59 . 2013-02-05 18:59 -------- d-----w- c:\program files\Common Files\AVG Secure Search
2013-02-05 18:59 . 2013-02-05 18:59 -------- d-----w- c:\program files\AVG Secure Search
2013-02-05 18:58 . 2013-02-05 18:59 -------- d-----w- c:\windows\LastGood.Tmp
2013-02-05 18:58 . 2013-02-05 18:58 -------- d-----w- C:\$AVG
2013-02-05 18:58 . 2013-02-05 19:00 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG2013
2013-02-05 18:57 . 2013-02-05 18:57 -------- d-----w- c:\program files\AVG
2013-02-05 18:49 . 2013-02-05 19:01 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2013-02-05 18:49 . 2013-02-05 18:49 -------- d-----w- c:\documents and settings\Tinel\Local Settings\Application Data\MFAData
2013-02-05 18:49 . 2013-02-05 18:49 -------- d-----w- c:\documents and settings\Tinel\Local Settings\Application Data\Avg2013
2013-02-05 18:37 . 2013-02-05 18:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-02-05 18:37 . 2012-12-14 14:49 21104 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-02-04 22:43 . 2013-02-04 22:43 -------- d-----w- c:\program files\NirSoft
2013-02-02 18:58 . 2013-02-02 18:58 -------- d-----w- c:\documents and settings\Tinel\Local Settings\Application Data\Innovative Solutions
2013-02-02 18:58 . 2013-02-02 18:58 -------- d-----w- c:\program files\Innovative Solutions
2013-02-02 18:38 . 2009-08-21 21:07 620032 ----a-w- c:\windows\system32\xtsupermenuHook.dll
2013-02-02 18:38 . 2008-02-24 14:17 11264 ----a-w- c:\windows\system32\drivers\supermounter.sys
2013-02-02 18:38 . 2007-03-11 19:39 44000 ----a-w- c:\windows\system32\drivers\AFPUni.sys
2013-02-02 18:38 . 2007-03-11 19:39 43936 ----a-w- c:\windows\system32\drivers\AFPAnsi.sys
2013-02-02 18:38 . 2003-10-16 20:56 6144 ----a-w- c:\windows\system32\SuperRes.dll
2013-02-02 18:38 . 2003-10-11 08:24 89088 ----a-w- c:\windows\system32\Shreder.dll
2013-02-02 18:38 . 2003-09-06 20:32 73728 ----a-w- c:\windows\system32\smh.dat
2013-02-02 18:38 . 2008-08-04 12:21 1509376 ----a-w- c:\windows\system32\context.dll
2013-02-02 18:38 . 2013-02-02 18:38 -------- d-----w- c:\program files\XP Tools
2013-01-30 22:58 . 2013-01-30 22:58 -------- d-----w- c:\program files\ESET
2013-01-30 22:20 . 2013-01-30 22:20 -------- d-----w- C:\_OTL
2013-01-27 21:11 . 2013-01-27 21:11 -------- d-----w- c:\documents and settings\Tinel\Application Data\Malwarebytes
2013-01-27 21:11 . 2013-01-27 21:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2013-01-27 20:46 . 2013-01-27 20:46 -------- d-----w- c:\windows\ERUNT
2013-01-27 20:46 . 2013-01-27 20:46 -------- d-----w- C:\JRT
2013-01-26 09:01 . 2013-01-26 09:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2013-01-25 22:32 . 2013-01-25 22:32 -------- d-----w- c:\documents and settings\LocalService\Application Data\QuickScan
2013-01-24 19:02 . 2013-01-24 19:02 -------- d-----w- c:\program files\Bitdefender
2013-01-23 09:19 . 2013-01-23 09:19 -------- d-----w- c:\documents and settings\All Users\Application Data\APN
2013-01-23 09:13 . 2013-01-23 09:13 -------- d-----w- c:\program files\CPUID
2013-01-22 21:34 . 2013-01-22 21:34 -------- d-----w- c:\documents and settings\Tinel\Application Data\SUPERAntiSpyware.com
2013-01-22 21:34 . 2013-01-22 21:47 -------- d-----w- c:\program files\SUPERAntiSpyware
2013-01-22 21:34 . 2013-01-22 21:34 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2013-01-22 19:40 . 2013-01-22 19:40 -------- d-----w- c:\documents and settings\Tinel\Doctor Web
2013-01-21 12:14 . 2013-01-21 12:14 -------- d-----w- c:\program files\ACW
2013-01-21 12:06 . 2013-01-21 12:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Panda Security
2013-01-21 12:06 . 2013-01-21 12:06 -------- d-----w- c:\program files\Panda USB Vaccine
2013-01-18 10:32 . 2013-01-18 10:32 -------- d-----w- c:\windows\system32\wbem\Repository
2013-01-18 10:26 . 2013-01-18 10:26 -------- d-----w- C:\Output
2013-01-18 10:23 . 2013-01-18 10:23 -------- d-----w- c:\documents and settings\All Users\Application Data\SystemExplorer
2013-01-18 10:23 . 2013-01-18 10:23 -------- d-----w- c:\program files\System Explorer
2013-01-18 10:22 . 2013-01-25 22:15 -------- d-----w- c:\program files\Uniblue
2013-01-18 10:22 . 2013-01-23 09:32 -------- d-----w- c:\documents and settings\Tinel\Application Data\Uniblue
2013-01-17 10:08 . 2013-01-18 10:15 -------- d-s---w- c:\documents and settings\Administrator
2013-01-13 15:57 . 2013-01-13 15:57 -------- d-----w- c:\documents and settings\Tinel\Application Data\WinZip
2013-01-13 15:52 . 2013-01-18 10:22 -------- d-----w- c:\program files\WinZip System Utilities Suite
2013-01-12 23:15 . 2013-01-18 10:22 -------- d-----w- c:\program files\SopCast
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-30 12:24 . 2012-03-30 08:36 697864 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-01-30 12:24 . 2011-10-25 15:18 74248 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-16 12:23 . 2002-08-29 12:00 290560 ----a-w- c:\windows\system32\atmfd.dll
2012-11-27 09:52 . 2012-11-27 10:52 179336 ----a-w- c:\program files\64res.dll
2012-11-15 21:33 . 2012-11-15 21:33 94048 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2012-11-13 01:25 . 2002-08-29 12:00 1866368 ----a-w- c:\windows\system32\win32k.sys
2013-01-19 14:26 . 2013-01-19 14:26 262552 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DriverMax"="c:\program files\Innovative Solutions\DriverMax\drivermax.exe" [2013-01-16 11325304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2012-12-11 3147384]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2013-02-05 1046984]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoFileAssociate"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2013\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
backup=c:\windows\pss\McAfee Security Scan Plus.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Tinel^Start Menu^Programs^Startup^PandaUSBVaccine.lnk]
path=c:\documents and settings\Tinel\Start Menu\Programs\Startup\PandaUSBVaccine.lnk
backup=c:\windows\pss\PandaUSBVaccine.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Tinel^Start Menu^Programs^Startup^Webshots.lnk]
path=c:\documents and settings\Tinel\Start Menu\Programs\Startup\Webshots.lnk
backup=c:\windows\pss\Webshots.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
2008-04-09 18:14 136472 ----a-w- c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcronisTimounterMonitor]
2008-04-09 18:23 909208 ----a-w- c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2007-03-09 08:09 63712 ----a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Agent]
2002-10-01 13:57 94208 ----a-w- c:\program files\CyberLink\PowerVCRII\agent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
2008-04-14 02:42 110592 ------w- c:\windows\system32\bthprops.cpl
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 02:42 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DW7]
2013-01-20 23:43 13105848 ----a-w- c:\program files\The Weather Channel\The Weather Channel App\TWCApp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EaseUs Tray]
2011-12-26 11:06 743560 ----a-w- c:\program files\EASEUS\Todo Backup\bin\TrayNotify.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EaseUs Watch]
2011-12-22 21:09 70792 ----a-w- c:\program files\EASEUS\Todo Backup\bin\EuWatch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\emMON]
2006-05-30 19:24 61440 ----a-w- c:\windows\emMON.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2003-03-11 06:11 114688 ----a-w- c:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
2004-05-12 13:18 241664 ----a-w- c:\program files\HP\hpcoretech\hpcmpmgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2004-02-12 11:38 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2003-03-11 06:24 155648 ----a-w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBAgent]
2012-01-13 13:22 1493288 ----a-w- c:\program files\Nero\Nero 11\Nero BackItUp\NBAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Remote_Agent]
2004-09-10 08:05 40960 ----a-w- c:\program files\CyberLink\PowerVCRII\RemoteAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-07-03 07:04 252848 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2013-01-22 21:47 4763008 ----a-w- c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
2008-04-09 18:11 2595792 ----a-w- c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"TuneUp.UtilitiesSvc"=2 (0x2)
"SystemExplorerHelpService"=3 (0x3)
"SkypeUpdate"=2 (0x2)
"Pml Driver HPZ12"=2 (0x2)
"PCCUJobMgr"=2 (0x2)
"Norton PC Checkup Application Launcher"=2 (0x2)
"NitroReaderDriverReadSpool2"=3 (0x3)
"NitroDriverReadSpool2"=3 (0x3)
"Nero BackItUp Scheduler 4.0"=2 (0x2)
"NAV"=2 (0x2)
"NAUpdate"=2 (0x2)
"MozillaMaintenance"=3 (0x3)
"MDM"=3 (0x3)
"McAfee SiteAdvisor Service"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"gusvc"=3 (0x3)
"gupdatem"=3 (0x3)
"gupdate"=2 (0x2)
"DefaultTabUpdate"=2 (0x2)
"AdobeFlashPlayerUpdateSvc"=3 (0x3)
"!SASCORE"=2 (0x2)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\CyberLink\\PowerVCRII\\PVCR.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\Tinel\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Nero\\KM\\KwikMedia.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgemcx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [10/15/2012 3:48 AM 55776]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [9/21/2012 3:46 AM 177376]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [9/14/2012 3:05 AM 35552]
R0 EUBAKUP;EUBAKUP;c:\windows\system32\drivers\eubakup.sys [1/6/2012 12:14 PM 50312]
R0 EUBKMON;EUBKMON;c:\windows\system32\drivers\EUBKMON.sys [1/6/2012 12:14 PM 43784]
R0 NBVol;Nero Backup Volume Filter Driver;c:\windows\system32\drivers\NBVol.sys [8/9/2012 9:01 PM 56496]
R0 NBVolUp;Nero Backup Volume Upper Filter Driver;c:\windows\system32\drivers\NBVolUp.sys [8/9/2012 9:01 PM 12464]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [10/22/2012 1:02 PM 179936]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [9/21/2012 3:45 AM 19936]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [10/2/2012 3:30 AM 159712]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [9/21/2012 3:46 AM 164832]
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2/5/2013 8:59 PM 26984]
R1 EUDSKACS;EUDSKACS;c:\windows\system32\drivers\eudskacs.sys [1/6/2012 12:14 PM 16008]
R1 EUFDDISK;EUFDDISK;c:\windows\system32\drivers\EuFdDisk.sys [1/6/2012 12:14 PM 185864]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 6:27 PM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/12/2011 11:55 PM 67664]
R1 SLEE_17_DRIVER;Steganos Live Encryption Engine 17 [Driver];c:\windows\system32\drivers\SleeN17.sys [2/17/2010 2:21 PM 94560]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [11/15/2012 11:34 PM 5814904]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [10/22/2012 1:05 PM 196664]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2/5/2013 8:37 PM 682344]
R2 PCCUJobMgr;Common Client Job Manager Service;c:\program files\Norton PC Checkup\Engine\2.0.17.48\ccSvcHst.exe [4/4/2012 9:48 AM 126392]
R2 pdserv;Bitdefender 60-Second Virus Scanner Service;c:\program files\Bitdefender\60-Second Virus Scanner\pdscan.exe \svc --> c:\program files\Bitdefender\60-Second Virus Scanner\pdscan.exe \svc [?]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe [7/4/2012 9:49 AM 1528672]
R2 vToolbarUpdater13.3.2;vToolbarUpdater13.3.2;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\13.3.2\ToolbarUpdater.exe [2/5/2013 8:59 PM 894920]
R3 {5C8B2B62-A385-11d5-A78B-00104B672758};AIM 3.0 Part 01 Codec Driver CH-7017-A;c:\windows\system32\drivers\a311.sys [10/25/2011 12:58 PM 31287]
R3 {5C8B2B65-A385-11d5-A78B-00104B672758};AIM 3.0 Part 01 Codec Driver CH-7017-B;c:\windows\system32\drivers\a310.sys [10/25/2011 12:58 PM 33335]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2/5/2013 8:37 PM 21104]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys [5/3/2012 9:43 AM 10064]
S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [2/5/2013 8:37 PM 398184]
S3 ALSysIO;ALSysIO;\??\c:\docume~1\Tinel\LOCALS~1\Temp\ALSysIO.sys --> c:\docume~1\Tinel\LOCALS~1\Temp\ALSysIO.sys [?]
S3 cpudrv;cpudrv;\??\c:\program files\SystemRequirementsLab\cpudrv.sys --> c:\program files\SystemRequirementsLab\cpudrv.sys [?]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [10/30/2011 9:10 PM 13192]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [10/30/2011 9:10 PM 8456]
S4 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [7/11/2012 8:54 PM 116608]
S4 EaseUS Agent;EaseUS Agent;c:\program files\EASEUS\Todo Backup\bin\Agent.exe [1/6/2012 12:09 PM 61064]
S4 Guard Agent;Guard Agent;c:\program files\EASEUS\Todo Backup\bin\GuardAgent.exe [1/6/2012 12:09 PM 23176]
S4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\siteadvisor\mcsacore.exe [8/29/2012 10:49 PM 95232]
S4 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [11/25/2011 3:32 PM 687400]
S4 NitroDriverReadSpool2;NitroPDFDriverCreatorReadSpool2;c:\program files\Nitro PDF\Professional 7\NitroPDFDriverService2.exe [5/16/2012 2:33 PM 184840]
S4 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\program files\Nitro PDF\Reader 2\NitroPDFReaderDriverService2.exe [5/16/2012 8:11 PM 184848]
S4 nlsX86cc;Nalpeiron Licensing Service;c:\windows\system32\NLSSRV32.EXE [5/16/2012 2:33 PM 69640]
S4 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;c:\program files\Norton PC Checkup\Engine\2.0.17.48\SymcPCCULaunchSvc.exe [4/4/2012 9:48 AM 123320]
S4 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [7/13/2012 1:14 PM 160944]
S4 SystemExplorerHelpService;System Explorer Service;c:\program files\System Explorer\service\SystemExplorerService.exe [12/5/2012 9:24 PM 567256]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MBAMSCHEDULER
.
Contents of the 'Scheduled Tasks' folder
.
2013-02-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 12:24]
.
2013-02-05 c:\windows\Tasks\cardworksShakeIcon.job
- c:\program files\NCH Software\CardWorks\cardworks.exe [2011-12-25 17:38]
.
2013-01-23 c:\windows\Tasks\DriverScanner.job
- c:\program files\Uniblue\DriverScanner\driverscanner.exe [2013-01-23 06:56]
.
2013-01-23 c:\windows\Tasks\dsmonitor.job
- c:\program files\Uniblue\DriverScanner\dsmonitor.exe [2013-01-23 06:56]
.
2013-02-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-16 17:45]
.
2013-02-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-16 17:45]
.
2013-01-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1390067357-220523388-1801674531-1004Core.job
- c:\documents and settings\Tinel\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-09-23 18:00]
.
2013-02-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1390067357-220523388-1801674531-1004UA.job
- c:\documents and settings\Tinel\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-09-23 18:00]
.
2013-02-05 c:\windows\Tasks\photopadShakeIcon.job
- c:\program files\NCH Software\PhotoPad\photopad.exe [2012-01-01 21:11]
.
2012-08-11 c:\windows\Tasks\pixillionDowngrade.job
- c:\program files\NCH Software\Pixillion\pixillion.exe [2012-01-01 21:11]
.
2012-08-11 c:\windows\Tasks\pixillionShakeIcon.job
- c:\program files\NCH Software\Pixillion\pixillion.exe [2012-01-01 21:11]
.
.
------- Supplementary Scan -------
.
uStart Page =
hxxp://us.mg5.mail.yahoo.com/neo/launchIE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Free YouTube Download - c:\documents and settings\Tinel\Application Data\DVDVideoSoftIEHelpers\freeytvdownloader.htm
IE: Free YouTube to MP3 Converter - c:\documents and settings\Tinel\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\13.3.2\ViProtocol.dll
DPF: DirectAnimation Java Classes -
file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java -
file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Tinel\Application Data\Mozilla\Firefox\Profiles\7pqu4e97.default\
FF - ExtSQL: 2013-01-12 01:03; {1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}; c:\documents and settings\Tinel\Application Data\Mozilla\Firefox\Profiles\7pqu4e97.default\extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}
FF - ExtSQL: 2013-02-05 20:59; avg@toolbar; c:\documents and settings\All Users\Application Data\AVG Secure Search\FireFoxExt\13.3.0.17
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{95B7759C-8C7F-4BF1-B163-73684A933233} - (no file)
Toolbar-{95B7759C-8C7F-4BF1-B163-73684A933233} - (no file)
HKCU-Run-DriverMax_RESTART - (no file)
MSConfigStartUp-Adobe ARM - c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
MSConfigStartUp-K!IR - c:\program files\K!TV\K!IR.exe
MSConfigStartUp-SearchSettings - c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2013-02-06 00:53
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\PCCUJobMgr]
"ImagePath"="\"c:\program files\Norton PC Checkup\Engine\2.0.17.48\ccSvcHst.exe\" /s \"PCCUJobMgr\" /m \"c:\program files\Norton PC Checkup\Engine\2.0.17.48\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'lsass.exe'(1064)
c:\windows\system32\relog_ap.dll
.
- - - - - - - > 'explorer.exe'(2128)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\netdde.exe
c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
c:\program files\Bitdefender\60-Second Virus Scanner\pdscan.exe
c:\windows\system32\wscntfy.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\TuneUp Utilities 2012\TuneUpUtilitiesApp32.exe
c:\program files\AVG\AVG2013\avgmfapx.exe
c:\program files\TuneUp Utilities 2012\OneClickStarter.exe
.
**************************************************************************
.
Completion time: 2013-02-06 01:11:55 - machine was rebooted
ComboFix-quarantined-files.txt 2013-02-05 23:11
.
Pre-Run: 10,979,131,392 bytes free
Post-Run: 10,889,646,080 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn /bootlog
.
- - End Of File - - E9224F8C4CFF7F3A73A4E402EF4A185F