ComboFix 12-12-02.01 - Ben 02/12/2012 21:06:34.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.2811.1760 [GMT 0:00]
Running from: c:\users\Ben\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\FullRemove.exe
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\ANTIGEN.dll
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\ANTIGEN.tmp
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\CLSV.dll
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\CLSV.exe
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\CLSV.sys
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\CLSV.tmp
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\DBOLE.exe
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\delfile.dll
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\delfile.drv
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\delfile.tmp
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\dudl.exe
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\dudl.tmp
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\eb.sys
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\energy.drv
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\energy.sys
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\exec.exe
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\exec.sys
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\fan.dll
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\FW.dll
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\FW.drv
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\gid.exe
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\gid.tmp
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\grid.tmp
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\hymt.sys
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\kernel32.dll
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\kernel32.drv
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\pal.exe
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\pal.sys
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\PE.dll
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\PE.exe
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\PE.sys
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\PE.tmp
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\ppal.tmp
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\SICKBOY.dll
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\SICKBOY.drv
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\SICKBOY.exe
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\sld.dll
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\sld.drv
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\SM.sys
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\snl2w.drv
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\std.dll
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\std.tmp
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\tjd.drv
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\tjd.exe
c:\users\Ben\AppData\Roaming\Microsoft\Windows\Recent\tjd.sys
.
.
((((((((((((((((((((((((( Files Created from 2012-11-02 to 2012-12-02 )))))))))))))))))))))))))))))))
.
.
2012-12-02 21:17 . 2012-12-02 21:17--------d-----w-c:\users\Default\AppData\Local\temp
2012-12-01 16:28 . 2012-12-01 16:28--------d-----w-c:\users\Ben\AppData\Roaming\SUPERAntiSpyware.com
2012-12-01 16:28 . 2012-12-01 16:28--------d-----w-c:\program files\SUPERAntiSpyware
2012-12-01 16:28 . 2012-12-01 16:28--------d-----w-c:\programdata\SUPERAntiSpyware.com
2012-12-01 08:22 . 2012-12-01 08:22163056----a-w-c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10142.bin
2012-12-01 08:16 . 2012-07-26 04:472560----a-w-c:\windows\system32\drivers\en-US\wdf01000.sys.mui
2012-12-01 08:16 . 2012-07-26 04:55785512----a-w-c:\windows\system32\drivers\Wdf01000.sys
2012-12-01 08:16 . 2012-07-26 04:5554376----a-w-c:\windows\system32\drivers\WdfLdr.sys
2012-12-01 08:16 . 2012-07-26 02:369728----a-w-c:\windows\system32\Wdfres.dll
2012-12-01 07:41 . 2012-07-26 02:2687040----a-w-c:\windows\system32\drivers\WUDFPf.sys
2012-12-01 07:41 . 2012-07-26 02:26198656----a-w-c:\windows\system32\drivers\WUDFRd.sys
2012-12-01 07:41 . 2012-07-26 03:0884992----a-w-c:\windows\system32\WUDFSvc.dll
2012-12-01 07:41 . 2012-07-26 03:08194048----a-w-c:\windows\system32\WUDFPlatform.dll
2012-12-01 07:40 . 2012-07-26 03:08229888----a-w-c:\windows\system32\WUDFHost.exe
2012-12-01 07:40 . 2012-07-26 03:08744448----a-w-c:\windows\system32\WUDFx.dll
2012-12-01 07:40 . 2012-07-26 03:0845056----a-w-c:\windows\system32\WUDFCoinstaller.dll
2012-12-01 00:46 . 2012-12-01 00:4676232----a-w-c:\programdata\Microsoft\Windows Defender\Definition Updates\{F17B13FB-DEFC-4F77-9B9A-FA2CD3278C0A}\offreg.dll
2012-12-01 00:33 . 2012-12-01 08:34--------d-----w-c:\program files (x86)\DownloadManager
2012-12-01 00:13 . 2012-12-01 00:13--------d-----w-c:\program files (x86)\Common Files\Java
2012-12-01 00:12 . 2012-12-01 00:1295208----a-w-c:\windows\SysWow64\WindowsAccessBridge-32.dll
2012-11-30 21:25 . 2012-08-21 13:0133240----a-w-c:\windows\system32\drivers\GEARAspiWDM.sys
2012-11-30 21:23 . 2012-11-30 21:25--------d-----w-c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2012-11-30 21:23 . 2012-11-30 21:25--------d-----w-c:\program files\iTunes
2012-11-30 21:23 . 2012-11-30 21:25--------d-----w-c:\program files (x86)\iTunes
2012-11-30 21:23 . 2012-11-30 21:23--------d-----w-c:\program files\iPod
2012-11-30 21:22 . 2012-11-30 21:22--------d-----w-c:\users\Ben\AppData\Roaming\Malwarebytes
2012-11-30 21:21 . 2012-11-30 21:21--------d-----w-c:\programdata\Malwarebytes
2012-11-30 21:21 . 2012-12-01 16:52--------d-----w-c:\program files (x86)\Malwarebytes' Anti-Malware
2012-11-30 21:21 . 2012-09-29 19:5425928----a-w-c:\windows\system32\drivers\mbam.sys
2012-11-30 21:14 . 2012-11-30 21:14159744----a-w-c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2012-11-30 21:14 . 2012-11-30 21:14159744----a-w-c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2012-11-30 21:14 . 2012-11-30 21:14159744----a-w-c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2012-11-30 21:14 . 2012-11-30 21:14159744----a-w-c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2012-11-30 21:14 . 2012-11-30 21:14159744----a-w-c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2012-11-30 21:14 . 2012-11-30 21:14159744----a-w-c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2012-11-30 21:14 . 2012-11-30 21:14159744----a-w-c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2012-11-30 21:13 . 2012-11-30 21:14--------d-----w-c:\program files (x86)\QuickTime
2012-11-30 20:26 . 2012-08-31 18:191659760----a-w-c:\windows\system32\drivers\ntfs.sys
2012-11-30 20:26 . 2012-10-09 18:1755296----a-w-c:\windows\system32\dhcpcsvc6.dll
2012-11-30 20:26 . 2012-10-09 18:17226816----a-w-c:\windows\system32\dhcpcore6.dll
2012-11-30 20:26 . 2012-10-09 17:4044032----a-w-c:\windows\SysWow64\dhcpcsvc6.dll
2012-11-30 20:26 . 2012-10-09 17:40193536----a-w-c:\windows\SysWow64\dhcpcore6.dll
2012-11-30 20:24 . 2012-08-02 17:58574464----a-w-c:\windows\system32\d3d10level9.dll
2012-11-30 20:23 . 2012-08-21 21:01245760----a-w-c:\windows\system32\OxpsConverter.exe
2012-11-30 20:23 . 2012-08-11 00:56715776----a-w-c:\windows\system32\kerberos.dll
2012-11-30 20:23 . 2012-08-10 23:56542208----a-w-c:\windows\SysWow64\kerberos.dll
2012-11-30 20:23 . 2012-09-25 22:4695744----a-w-c:\windows\system32\synceng.dll
2012-11-30 20:23 . 2012-09-25 22:4778336----a-w-c:\windows\SysWow64\synceng.dll
2012-11-30 20:22 . 2012-07-04 22:1673216----a-w-c:\windows\system32\netapi32.dll
2012-11-30 20:22 . 2012-07-04 22:1359392----a-w-c:\windows\system32\browcli.dll
2012-11-30 20:22 . 2012-07-04 22:13136704----a-w-c:\windows\system32\browser.dll
2012-11-30 20:22 . 2012-07-04 21:1441984----a-w-c:\windows\SysWow64\browcli.dll
2012-11-30 20:22 . 2012-05-05 08:36503808----a-w-c:\windows\system32\srcore.dll
2012-11-30 20:22 . 2012-05-05 07:4643008----a-w-c:\windows\SysWow64\srclient.dll
2012-11-30 20:22 . 2012-05-14 05:26956928----a-w-c:\windows\system32\localspl.dll
2012-11-30 20:22 . 2012-02-11 06:43751104----a-w-c:\windows\system32\win32spl.dll
2012-11-30 20:22 . 2012-02-11 06:36559104----a-w-c:\windows\system32\spoolsv.exe
2012-11-30 20:22 . 2012-02-11 06:3667072----a-w-c:\windows\splwow64.exe
2012-11-30 20:22 . 2012-02-11 05:43492032----a-w-c:\windows\SysWow64\win32spl.dll
2012-11-30 20:18 . 2012-06-02 05:411464320----a-w-c:\windows\system32\crypt32.dll
2012-11-30 20:18 . 2012-06-02 04:361159680----a-w-c:\windows\SysWow64\crypt32.dll
2012-11-30 20:18 . 2012-06-02 05:41184320----a-w-c:\windows\system32\cryptsvc.dll
2012-11-30 20:18 . 2012-06-02 05:41140288----a-w-c:\windows\system32\cryptnet.dll
2012-11-30 20:18 . 2012-06-02 04:36140288----a-w-c:\windows\SysWow64\cryptsvc.dll
2012-11-30 20:18 . 2012-06-02 04:36103936----a-w-c:\windows\SysWow64\cryptnet.dll
2012-11-30 20:10 . 2012-11-19 01:019125352----a-w-c:\programdata\Microsoft\Windows Defender\Definition Updates\{F17B13FB-DEFC-4F77-9B9A-FA2CD3278C0A}\mpengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-01 00:12 . 2012-08-08 14:50746984----a-w-c:\windows\SysWow64\deployJava1.dll
2012-12-01 00:12 . 2012-08-08 14:50821736----a-w-c:\windows\SysWow64\npDeployJava1.dll
2012-10-29 21:04 . 2011-12-26 21:1066395536----a-w-c:\windows\system32\MRT.exe
2012-10-25 03:12 . 2012-10-25 03:1294208----a-w-c:\windows\SysWow64\QuickTimeVR.qtx
2012-10-25 03:12 . 2012-10-25 03:1269632----a-w-c:\windows\SysWow64\QuickTime.qts
2012-10-16 08:38 . 2012-11-30 20:22135168----a-w-c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2012-10-16 08:38 . 2012-11-30 20:22350208----a-w-c:\windows\apppatch\AppPatch64\AcLayers.dll
2012-10-16 07:39 . 2012-11-30 20:22561664----a-w-c:\windows\apppatch\AcLayers.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-11-01 5629312]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-04-08 908368]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2010-03-08 260608]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-29 98304]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-11-02 59240]
"SSDMonitor"="c:\program files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe" [2010-11-15 112600]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-11 348664]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-11-29 151952]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-29 676936]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-11-06 50432]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [2010-02-08 239136]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-08-02 51712]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-12-27 1255736]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-10-11 27760]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2012-07-11 140672]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-03-29 202752]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-08-11 86224]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2010-04-08 312400]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2010-04-23 867360]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-29 399432]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-03-08 250368]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-11-06 144640]
S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2011-01-28 632792]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2010-01-28 243232]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2010-03-20 321064]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-29 25928]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-22 38456]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-12-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1854881093-1891650897-3381262075-1000Core.job
- c:\users\Ben\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-08 14:02]
.
2012-12-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1854881093-1891650897-3381262075-1000UA.job
- c:\users\Ben\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-08 14:02]
.
2012-12-02 c:\windows\Tasks\RMSchedule.job
- c:\program files (x86)\Registry Mechanic\RegMech.exe [2011-08-20 09:02]
.
2012-12-02 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 1611a78d-bbca-4470-aecd-cac6d2be45e3.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]
.
2012-12-01 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 36f5f7c3-bd92-47fb-96ab-5d146151f58c.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-12-15 9644576]
"PLFSetI"="c:\windows\PLFSetI.exe" [2010-01-13 206208]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2010-04-23 861216]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://
www.google.com
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&m=aspire_5551&r=27361210w115l0434z1k5t4632k54q
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&m=aspire_5551&r=27361210w115l0434z1k5t4632k54q
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.1.254
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
HKLM-Run-mwlDaemon - c:\program files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-12-02 21:20:59
ComboFix-quarantined-files.txt 2012-12-02 21:20
.
Pre-Run: 165,752,238,080 bytes free
Post-Run: 165,486,837,760 bytes free
.
- - End Of File - - DFDAE7229F1859011A4B8DBEB17B787D