ComboFix 11-07-07.06 - penylane 07/08/2011 1:54.1.3 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.2942.2042 [GMT -4:00] Running from: c:\users\penylane\Desktop\ComboFix.exe AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\cleanup.exe C:\zip.exe . . ((((((((((((((((((((((((( Files Created from 2011-06-08 to 2011-07-08 ))))))))))))))))))))))))))))))) . . 2011-07-08 06:00 . 2011-07-08 06:00 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-07-08 00:18 . 2011-07-07 23:08 460888 ----a-w- c:\windows\system32\drivers\56541832.sys 2011-07-07 21:29 . 2011-07-07 23:08 460888 ----a-w- c:\windows\system32\drivers\98937039.sys 2011-07-07 16:41 . 2011-07-07 16:41 -------- d-----w- c:\programdata\Kaspersky Lab 2011-07-06 11:17 . 2011-07-06 11:17 -------- d-----w- C:\avrescue 2011-07-06 01:00 . 2010-11-09 18:56 27472 ----a-w- c:\windows\system32\sbbd.exe 2011-07-06 01:00 . 2011-07-06 01:42 -------- d-----w- C:\VIPRERESCUE 2011-07-06 00:21 . 2011-07-06 00:21 -------- d-----w- c:\program files (x86)\Drumagog 5 2011-07-06 00:20 . 2011-07-06 00:20 -------- d-----w- c:\program files (x86)\Sony 2011-07-06 00:16 . 2011-07-06 00:16 -------- d-----w- c:\users\penylane\AppData\Roaming\Publish Providers 2011-07-06 00:13 . 2011-07-06 00:13 -------- d-----w- c:\users\penylane\AppData\Local\Sony 2011-07-05 23:39 . 2011-07-05 23:39 -------- d-----w- c:\programdata\Sony 2011-07-05 23:08 . 2011-07-06 00:19 -------- d-----w- c:\users\penylane\AppData\Roaming\Sony 2011-07-05 22:41 . 2011-07-05 22:41 -------- d-----w- c:\users\penylane\AppData\Roaming\OpenOffice.org 2011-07-05 22:23 . 2011-07-05 22:23 -------- d-----w- c:\program files (x86)\OpenOffice.org 3 2011-07-05 22:23 . 2011-07-05 22:23 -------- d-----w- c:\program files (x86)\Common Files\Java 2011-07-05 22:23 . 2011-07-05 22:22 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll 2011-07-05 22:22 . 2011-07-05 22:22 -------- d-----w- c:\program files (x86)\Java 2011-07-05 15:04 . 2011-06-07 14:10 8873296 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CA50F641-191A-4B0A-AA9E-EB165FFF76EA}\mpengine.dll 2011-07-01 15:22 . 2011-07-01 15:22 61440 ----a-w- c:\windows\SysWow64\drivers\thjbgccm.sys 2011-07-01 15:22 . 2011-07-01 15:22 574 ----a-w- C:\cleanup.bat 2011-07-01 15:21 . 2011-07-01 15:21 -------- d-----w- c:\users\penylane\AppData\Roaming\SUPERAntiSpyware.com 2011-07-01 15:21 . 2011-07-01 15:21 -------- d-----w- c:\programdata\SUPERAntiSpyware.com 2011-07-01 15:21 . 2011-07-01 15:21 -------- d-----w- c:\programdata\!SASCORE 2011-07-01 15:20 . 2011-07-01 15:21 -------- d-----w- c:\program files\SUPERAntiSpyware 2011-06-29 21:38 . 2011-06-29 21:38 -------- d-----w- c:\users\penylane\AppData\Roaming\Uniblue 2011-06-29 21:38 . 2011-06-29 21:38 -------- d-----w- c:\program files (x86)\Uniblue 2011-06-29 19:22 . 2011-06-29 19:22 -------- d-----w- c:\program files\CheckPoint 2011-06-29 19:22 . 2011-06-29 19:22 -------- d-----w- c:\windows\system32\ZoneLabs 2011-06-29 19:20 . 2011-06-29 19:20 -------- d-----w- c:\users\penylane\AppData\Roaming\IObit 2011-06-29 19:20 . 2011-06-29 19:20 -------- d-----w- c:\program files (x86)\IObit 2011-06-29 19:08 . 2011-06-29 19:08 -------- d-----w- c:\users\penylane\AppData\Roaming\AVG10 2011-06-29 19:03 . 2011-06-29 19:03 -------- d-----w- C:\8a287a8ca726a47d6ac36b 2011-06-29 19:02 . 2011-06-29 19:02 -------- d-----w- c:\users\penylane\AppData\Roaming\WinPatrol 2011-06-29 19:01 . 2011-02-22 17:57 74824 ----a-w- c:\windows\system32\drivers\TfSysMon.sys 2011-06-29 19:01 . 2011-02-22 17:57 41888 ----a-w- c:\windows\system32\drivers\TfNetMon.sys 2011-06-29 19:01 . 2011-02-22 17:57 65072 ----a-w- c:\windows\system32\drivers\TfFsMon.sys 2011-06-29 19:01 . 2011-06-29 19:02 -------- d-----w- c:\program files (x86)\ThreatFire 2011-06-29 19:01 . 2011-06-29 19:01 -------- d-----w- c:\programdata\PC Tools 2011-06-29 19:01 . 2011-06-29 19:01 -------- d-----w- c:\programdata\CheckPoint 2011-06-29 19:01 . 2011-06-29 19:01 -------- d-----w- c:\program files (x86)\BillP Studios 2011-06-29 19:01 . 2011-06-29 19:01 -------- d-----w- c:\programdata\InstallMate 2011-06-29 18:58 . 2011-06-29 18:58 -------- d--h--w- c:\programdata\Common Files 2011-06-29 18:58 . 2011-06-29 18:58 -------- d-----w- c:\users\penylane\AppData\Roaming\Malwarebytes 2011-06-29 18:58 . 2011-05-29 13:11 39984 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys 2011-06-29 18:58 . 2011-06-29 18:58 -------- d-----w- c:\programdata\Malwarebytes 2011-06-29 18:58 . 2011-05-29 13:11 25912 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-06-29 18:57 . 2011-06-29 18:58 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware 2011-06-29 18:54 . 2011-07-08 05:48 -------- d-----w- c:\programdata\AVG10 2011-06-29 18:53 . 2011-07-04 11:43 253888 ----a-w- c:\windows\system32\aswBoot.exe 2011-06-29 18:52 . 2011-07-08 05:41 -------- d-----w- c:\programdata\AVAST Software 2011-06-29 18:52 . 2011-06-29 18:52 -------- d-----w- c:\program files\AVAST Software 2011-06-29 18:52 . 2011-06-29 18:52 -------- d-----w- c:\program files (x86)\AVG 2011-06-29 03:41 . 2011-07-08 05:40 -------- d-----w- c:\programdata\MFAData 2011-06-28 22:49 . 2011-06-28 22:49 106496 ----a-r- c:\users\penylane\AppData\Roaming\Microsoft\Installer\{5866520C-8857-4986-833A-039F4584C3F7}\Toontrack_solo.exe1_5866520C88574986833A039F4584C3F7.exe 2011-06-28 22:49 . 2011-06-28 22:49 106496 ----a-r- c:\users\penylane\AppData\Roaming\Microsoft\Installer\{5866520C-8857-4986-833A-039F4584C3F7}\Toontrack_solo.exe_5866520C88574986833A039F4584C3F7.exe 2011-06-28 22:07 . 2011-06-28 22:07 -------- d-----w- c:\program files (x86)\Common Files\DigiDesign 2011-06-28 21:33 . 2011-06-28 23:31 -------- d-----w- c:\program files (x86)\Toontrack 2011-06-28 20:54 . 2011-06-28 20:54 -------- d-----w- c:\users\penylane\AppData\Roaming\Antares 2011-06-28 20:54 . 2011-06-28 20:54 -------- d-----w- c:\program files (x86)\Antares Audio Technologies 2011-06-28 20:46 . 2007-09-05 05:46 203328 ----a-w- c:\windows\SysWow64\drivers\mcdbus.sys 2011-06-28 20:46 . 2007-09-05 05:46 203328 ----a-w- c:\windows\system32\drivers\mcdbus.sys 2011-06-28 20:29 . 2011-06-28 20:29 -------- d-----w- c:\program files (x86)\Peavey Electronics 2011-06-28 03:26 . 2011-07-04 05:56 -------- d-----w- c:\users\penylane\AppData\Roaming\gtk-2.0 2011-06-28 03:15 . 2011-06-28 03:15 -------- d-----w- c:\users\penylane\.thumbnails 2011-06-28 01:00 . 2011-07-04 05:56 -------- d-----w- c:\users\penylane\.gimp-2.6 2011-06-27 21:10 . 2011-06-27 21:10 -------- d-----w- c:\program files (x86)\2d3 2011-06-27 21:09 . 2005-06-14 17:01 296448 ----a-w- c:\windows\system32\drivers\hardlock.sys 2011-06-27 21:09 . 2005-06-21 16:10 24576 ----a-w- c:\windows\SysWow64\hdsuinst.exe 2011-06-27 21:09 . 2005-09-28 18:24 2164411 ----a-w- c:\windows\SysWow64\haspds_windows.dll 2011-06-27 21:09 . 2001-09-28 23:00 164864 ----a-w- c:\windows\SysWow64\UNWISE.EXE 2011-06-27 21:07 . 2011-06-27 21:07 -------- d-----w- c:\windows\Downloaded Installations 2011-06-27 20:45 . 2011-06-27 20:45 -------- d-----w- c:\program files\Apoint2K 2011-06-27 20:45 . 2011-06-27 20:45 98816 ----a-w- c:\windows\system32\Vxdif.dll 2011-06-27 20:45 . 2011-06-27 20:45 1490656 ----a-w- c:\windows\system32\WdfCoInstaller01007.dll 2011-06-27 20:45 . 2011-06-27 20:45 243760 ----a-w- c:\windows\system32\drivers\Apfiltr.sys 2011-06-27 20:44 . 2011-06-27 20:44 9216 ----a-w- c:\windows\system32\AmUStor.dll 2011-06-27 20:44 . 2011-06-27 20:44 25600 ----a-w- c:\windows\system32\drivers\AmUStor.sys 2011-06-27 20:40 . 2011-06-27 20:40 -------- d-----w- c:\programdata\Uniblue 2011-06-27 14:35 . 2009-10-12 01:58 1177600 ----a-w- c:\windows\SysWow64\SYNSOEMU.DLL 2011-06-27 14:35 . 2011-06-27 14:35 -------- d-----w- c:\program files (x86)\Common Files\VST3 2011-06-27 14:30 . 2011-06-27 14:35 -------- d-----w- c:\program files (x86)\Common Files\Steinberg 2011-06-27 14:30 . 2011-06-27 14:30 -------- d-----w- c:\programdata\Steinberg 2011-06-27 14:26 . 2011-06-28 20:54 -------- d-----w- c:\program files (x86)\Steinberg 2011-06-27 02:35 . 2011-06-27 02:35 -------- d-----w- c:\program files (x86)\Elaborate Bytes 2011-06-27 02:22 . 2011-06-27 02:22 -------- d-----w- c:\program files (x86)\7-Zip 2011-06-27 01:49 . 2011-06-29 03:18 -------- d-----w- c:\users\penylane\AppData\Local\Apple Computer 2011-06-27 01:49 . 2011-06-29 02:53 -------- d-----w- c:\users\penylane\AppData\Roaming\Apple Computer 2011-06-27 01:48 . 2009-05-18 17:17 34152 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2011-06-27 01:48 . 2008-04-17 16:12 126312 ----a-w- c:\windows\system32\GEARAspi64.dll 2011-06-27 01:48 . 2008-04-17 16:12 107368 ----a-w- c:\windows\SysWow64\GEARAspi.dll 2011-06-27 01:47 . 2011-06-27 01:47 -------- d-----w- c:\program files\iPod 2011-06-27 01:47 . 2011-06-27 01:48 -------- d-----w- c:\programdata\{93E26451-CD9A-43A5-A2FA-C42392EA4001} 2011-06-27 01:47 . 2011-06-27 01:48 -------- d-----w- c:\program files\iTunes 2011-06-27 01:47 . 2011-06-27 01:48 -------- d-----w- c:\program files (x86)\iTunes 2011-06-27 01:46 . 2011-06-27 01:46 -------- d-----w- c:\program files (x86)\Apple Software Update 2011-06-27 01:46 . 2011-06-27 01:46 -------- d-----w- c:\program files\Common Files\Apple 2011-06-27 01:46 . 2011-06-27 01:46 -------- d-----w- c:\program files\Bonjour 2011-06-27 01:46 . 2011-06-27 01:46 -------- d-----w- c:\program files (x86)\Bonjour 2011-06-27 01:34 . 2011-06-27 01:34 -------- d-----w- c:\program files (x86)\GIMP-2.0 2011-06-27 01:30 . 2011-06-30 01:29 55384 ----a-w- c:\windows\system32\drivers\SBREDrv.sys 2011-06-27 01:29 . 2011-06-27 01:29 -------- d-----w- c:\program files (x86)\ASIO4ALL v2 2011-06-27 01:27 . 2011-07-08 05:44 -------- d-----w- c:\programdata\Lavasoft 2011-06-27 00:32 . 2011-06-27 00:32 -------- d-----w- c:\users\penylane\AppData\Roaming\Audacity 2011-06-27 00:32 . 2011-06-27 00:32 -------- d-----w- c:\program files (x86)\Audacity 1.3 Beta (Unicode) 2011-06-27 00:31 . 2011-06-27 00:31 -------- d-----w- c:\program files (x86)\Power Tab Software 2011-06-27 00:30 . 2011-06-27 14:36 -------- d-----w- c:\users\penylane\AppData\Roaming\Steinberg 2011-06-26 23:04 . 2004-08-31 21:47 21888 ----a-w- c:\windows\SysWow64\drivers\synUSB64.sys 2011-06-26 23:04 . 1999-12-01 04:40 401462 ----a-w- c:\windows\SysWow64\temp.000 2011-06-26 23:04 . 2011-06-27 00:42 -------- d-----w- c:\program files (x86)\Syncrosoft 2011-06-26 20:42 . 2011-06-26 20:42 2106216 ----a-w- c:\program files (x86)\Mozilla Firefox\D3DCompiler_43.dll 2011-06-26 20:42 . 2011-06-26 20:42 1998168 ----a-w- c:\program files (x86)\Mozilla Firefox\d3dx9_43.dll 2011-06-25 02:29 . 2011-06-25 02:31 -------- d-----w- c:\programdata\WinZip 2011-06-25 02:29 . 2011-07-06 01:12 -------- d-----w- c:\users\penylane\AppData\Roaming\Azureus 2011-06-25 02:28 . 2011-06-25 02:28 -------- d-----w- c:\program files (x86)\Vuze 2011-06-24 16:16 . 2011-06-24 16:24 -------- d-----w- c:\program files (x86)\Guitar Pro 5 2011-06-24 15:50 . 2011-06-28 17:44 -------- d-----r- c:\users\penylane\Dropbox 2011-06-24 15:37 . 2011-06-28 17:44 -------- d-----w- c:\users\penylane\AppData\Roaming\Dropbox 2011-06-24 15:04 . 2011-06-24 15:04 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll 2011-06-24 15:04 . 2011-06-24 15:04 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll 2011-06-24 15:04 . 2011-06-24 15:04 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll 2011-06-24 15:04 . 2011-06-24 15:04 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll 2011-06-24 15:04 . 2011-06-24 15:04 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll 2011-06-24 15:04 . 2011-06-24 15:04 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll 2011-06-24 15:04 . 2011-06-24 15:04 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-06-07 14:10 . 2011-04-29 01:27 8873296 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2011-05-24 23:14 . 2010-11-21 03:27 270720 ------w- c:\windows\system32\MpSigStub.exe 2011-04-24 20:41 . 2010-06-24 15:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-04-24 19:57 . 2011-04-24 19:57 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe 2011-04-24 19:57 . 2011-04-24 19:57 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll 2011-04-24 19:57 . 2011-04-24 19:57 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe 2011-04-24 19:57 . 2011-04-24 19:57 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe 2011-04-24 19:57 . 2011-04-24 19:57 74752 ----a-w- c:\windows\SysWow64\iesetup.dll 2011-04-24 19:57 . 2011-04-24 19:57 63488 ----a-w- c:\windows\SysWow64\tdc.ocx 2011-04-24 19:57 . 2011-04-24 19:57 49664 ----a-w- c:\windows\system32\imgutil.dll 2011-04-24 19:57 . 2011-04-24 19:57 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll 2011-04-24 19:57 . 2011-04-24 19:57 420864 ----a-w- c:\windows\SysWow64\vbscript.dll 2011-04-24 19:57 . 2011-04-24 19:57 367104 ----a-w- c:\windows\SysWow64\html.iec 2011-04-24 19:57 . 2011-04-24 19:57 35840 ----a-w- c:\windows\SysWow64\imgutil.dll 2011-04-24 19:57 . 2011-04-24 19:57 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll 2011-04-24 19:57 . 2011-04-24 19:57 222208 ----a-w- c:\windows\system32\msls31.dll 2011-04-24 19:57 . 2011-04-24 19:57 173056 ----a-w- c:\windows\system32\ieUnatt.exe 2011-04-24 19:57 . 2011-04-24 19:57 161792 ----a-w- c:\windows\SysWow64\msls31.dll 2011-04-24 19:57 . 2011-04-24 19:57 152064 ----a-w- c:\windows\SysWow64\wextract.exe 2011-04-24 19:57 . 2011-04-24 19:57 150528 ----a-w- c:\windows\SysWow64\iexpress.exe 2011-04-24 19:57 . 2011-04-24 19:57 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe 2011-04-24 19:57 . 2011-04-24 19:57 1427456 ----a-w- c:\windows\SysWow64\inetcpl.cpl 2011-04-24 19:57 . 2011-04-24 19:57 1389056 ----a-w- c:\windows\system32\wininet.dll 2011-04-24 19:57 . 2011-04-24 19:57 12288 ----a-w- c:\windows\system32\mshta.exe 2011-04-24 19:57 . 2011-04-24 19:57 11776 ----a-w- c:\windows\SysWow64\mshta.exe 2011-04-24 19:57 . 2011-04-24 19:57 114176 ----a-w- c:\windows\system32\admparse.dll 2011-04-24 19:57 . 2011-04-24 19:57 1126912 ----a-w- c:\windows\SysWow64\wininet.dll 2011-04-24 19:57 . 2011-04-24 19:57 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll 2011-04-24 19:57 . 2011-04-24 19:57 101888 ----a-w- c:\windows\SysWow64\admparse.dll 2011-04-24 19:57 . 2011-04-24 19:57 135168 ----a-w- c:\windows\system32\IEAdvpack.dll 2011-04-24 19:57 . 2011-04-24 19:57 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe 2011-04-24 19:57 . 2011-04-24 19:57 85504 ----a-w- c:\windows\system32\iesetup.dll 2011-04-24 19:57 . 2011-04-24 19:57 76800 ----a-w- c:\windows\system32\tdc.ocx 2011-04-24 19:57 . 2011-04-24 19:57 603648 ----a-w- c:\windows\system32\vbscript.dll 2011-04-24 19:57 . 2011-04-24 19:57 48640 ----a-w- c:\windows\system32\mshtmler.dll 2011-04-24 19:57 . 2011-04-24 19:57 448512 ----a-w- c:\windows\system32\html.iec 2011-04-24 19:57 . 2011-04-24 19:57 30720 ----a-w- c:\windows\system32\licmgr10.dll 2011-04-24 19:57 . 2011-04-24 19:57 165888 ----a-w- c:\windows\system32\iexpress.exe 2011-04-24 19:57 . 2011-04-24 19:57 160256 ----a-w- c:\windows\system32\wextract.exe 2011-04-24 19:57 . 2011-04-24 19:57 1492992 ----a-w- c:\windows\system32\inetcpl.cpl 2011-04-24 19:57 . 2011-04-24 19:57 111616 ----a-w- c:\windows\system32\iesysprep.dll 2011-04-18 13:15 . 2011-04-24 19:45 8802128 ------w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AD5374E7-6FB1-470F-90B7-DCC0B8DFEDB3}\mpengine.dll 2011-04-15 01:28 . 2011-04-15 01:28 118864 ----a-w- c:\windows\system32\drivers\AVGIDSDriver.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\users\penylane\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\users\penylane\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\users\penylane\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\users\penylane\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 Darusb_win7x;D-LInk DWA-160 11n Wireless LAN device driver;c:\windows\system32\DRIVERS\Darusb_win7x.sys [x] R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x] R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys [x] R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R4 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-05-04 128384] R4 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S0 56541832;56541832;c:\windows\system32\DRIVERS\56541832.sys [x] S0 98937039;98937039;c:\windows\system32\DRIVERS\98937039.sys [x] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360] S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616] S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x] . . . --------- x86-64 ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 ----a-w- c:\users\penylane\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 ----a-w- c:\users\penylane\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 ----a-w- c:\users\penylane\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 ----a-w- c:\users\penylane\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ------- Supplementary Scan ------- . mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\penylane\AppData\Roaming\Mozilla\Firefox\Profiles\6k5sxim9.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/ . - - - - ORPHANS REMOVED - - - - . AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe AddRemove-HASP HL Device Driver - c:\windows\System32\UNWISE.EXE . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-1508433428-442362985-4121305359-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.Email.1" . [HKEY_USERS\S-1-5-21-1508433428-442362985-4121305359-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.VCard.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DbgagD\1*] "value"="?\06\06\19\02\1c$?" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2011-07-08 02:07:22 - machine was rebooted ComboFix-quarantined-files.txt 2011-07-08 06:07 . Pre-Run: 194,348,879,872 bytes free Post-Run: 194,522,648,576 bytes free . - - End Of File - - 4AB8A12D3592AE129366E8F7EF90287E