ComboFix 11-11-17.03 - User 17/11/2011 20:54:56.1.8 - x64 Microsoft Windows 7 Professional 6.1.7601.1.1252.44.1033.18.12279.9541 [GMT 0:00] Running from: g:\virus tools\Combo-Fix.exe AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} FW: COMODO Firewall *Disabled* {4D6F75E0-14AF-2E9E-AACD-24CDCF08AA2A} SP: COMODO Defense+ *Disabled/Updated* {CE351521-78FA-2048-BB22-B68A4A5CA7EC} SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\Roaming c:\windows\SysWow64\ccrpTmr6.dll . . ((((((((((((((((((((((((( Files Created from 2011-10-17 to 2011-11-17 ))))))))))))))))))))))))))))))) . . 2011-11-17 20:59 . 2011-11-17 20:59 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-11-17 17:33 . 2011-11-17 17:33 69000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8BEA1B44-4522-41B0-BB5E-CBF5E73B8F68}\offreg.dll 2011-11-16 17:43 . 2011-10-07 04:16 8570192 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8BEA1B44-4522-41B0-BB5E-CBF5E73B8F68}\mpengine.dll 2011-11-15 23:36 . 2011-11-15 23:37 -------- d-----w- c:\program files\iTunes 2011-11-15 23:36 . 2011-11-15 23:36 -------- d-----w- c:\program files\iPod 2011-11-15 23:12 . 2011-11-15 23:12 -------- d-----w- c:\program files (x86)\FileHippo.com 2011-11-15 12:18 . 2011-11-15 12:18 111408 ----a-w- c:\windows\system32\drivers\67347612.sys 2011-11-13 22:29 . 2011-11-13 22:29 111408 ----a-w- c:\windows\system32\drivers\61273503.sys 2011-11-12 13:14 . 2011-11-12 13:14 111408 ----a-w- c:\windows\system32\drivers\47982798.sys 2011-11-10 17:50 . 2011-11-10 17:50 -------- d-----w- c:\programdata\Kaspersky Lab 2011-11-10 12:40 . 2011-11-10 12:50 25160 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys 2011-11-10 12:38 . 2011-11-10 12:40 -------- d-----w- c:\programdata\Hitman Pro 2011-11-10 11:35 . 2011-05-10 07:06 51712 ----a-w- c:\windows\system32\drivers\usbaapl64.sys 2011-11-10 11:28 . 2011-11-10 11:28 111408 ----a-w- c:\windows\system32\drivers\50370303.sys 2011-11-10 10:54 . 2011-10-01 05:45 886784 ----a-w- c:\program files\Common Files\System\wab32.dll 2011-11-10 10:54 . 2011-10-01 04:37 708608 ----a-w- c:\program files (x86)\Common Files\System\wab32.dll 2011-11-10 10:54 . 2011-09-29 16:29 1923952 ----a-w- c:\windows\system32\drivers\tcpip.sys 2011-11-10 10:53 . 2011-09-29 04:03 3144704 ----a-w- c:\windows\system32\win32k.sys 2011-11-08 10:44 . 2011-11-08 10:44 -------- d-----w- c:\users\User\AppData\Roaming\2BrightSparks 2011-11-08 10:07 . 2011-11-08 10:07 -------- d-----w- C:\VritualRoot 2011-11-07 23:07 . 2011-11-08 13:10 -------- d-----w- c:\programdata\Comodo 2011-11-07 23:07 . 2011-11-07 23:07 -------- d-----w- c:\program files\COMODO 2011-11-07 22:55 . 2011-11-07 22:55 -------- d-----w- c:\users\User\AppData\Local\VS Revo Group 2011-11-07 22:55 . 2009-12-30 11:21 31800 ----a-w- c:\windows\system32\drivers\revoflt.sys 2011-11-07 22:55 . 2011-11-07 22:55 -------- d-----w- c:\program files\VS Revo Group 2011-11-07 21:41 . 2011-11-07 23:07 -------- d-----w- c:\programdata\Comodo Downloader 2011-11-06 15:49 . 2009-07-14 00:00 6656 ----a-w- c:\windows\system32\drivers\beep.sys_old 2011-11-04 16:46 . 2011-11-04 16:46 -------- d-----w- c:\users\Default\AppData\Local\Trusteer 2011-10-24 18:35 . 2011-10-24 18:35 -------- d-----w- c:\program files\Bonjour 2011-10-24 18:35 . 2011-10-24 18:35 -------- d-----w- c:\program files (x86)\Bonjour 2011-10-24 14:29 . 2011-10-24 14:29 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx 2011-10-24 14:29 . 2011-10-24 14:29 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-11-15 23:18 . 2011-06-10 17:05 627600 ----a-w- c:\windows\system32\deployJava1.dll 2011-10-11 14:52 . 2011-10-11 14:52 917840 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A7851ACF-2E0C-4FFF-9855-CB501A14633A}\gapaengine.dll 2011-10-09 08:44 . 2011-10-11 14:52 601424 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll 2011-10-07 18:48 . 2011-10-07 18:48 93200 ----a-w- c:\windows\system32\drivers\inspect.sys 2011-10-07 18:47 . 2011-10-07 18:47 574216 ----a-w- c:\windows\system32\drivers\cmdGuard.sys 2011-10-07 18:47 . 2011-10-07 18:47 43248 ----a-w- c:\windows\system32\drivers\cmdhlp.sys 2011-10-07 18:47 . 2011-10-07 18:47 16528 ----a-w- c:\windows\system32\drivers\cmderd.sys 2011-10-07 18:47 . 2011-10-07 18:47 41200 ----a-w- c:\windows\system32\cmdcsr.dll 2011-10-07 18:47 . 2011-10-07 18:47 300200 ----a-w- c:\windows\SysWow64\guard32.dll 2011-10-07 18:47 . 2011-10-07 18:47 388280 ----a-w- c:\windows\system32\guard64.dll 2011-10-07 04:16 . 2011-10-10 09:42 8570192 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2011-10-03 08:54 . 2011-10-03 08:54 53248 ----a-r- c:\users\User\AppData\Roaming\Microsoft\Installer\{12BAA98C-F8DD-4BC9-BBE6-1C8463114197}\ARPPRODUCTICON.exe 2011-10-03 05:06 . 2011-01-25 11:32 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll 2011-09-25 15:24 . 2011-06-01 08:21 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2011-09-14 13:58 . 2010-12-04 18:49 274616 ----a-w- c:\windows\system32\drivers\keyscrambler.sys 2011-09-01 05:24 . 2011-10-13 14:50 2309120 ----a-w- c:\windows\system32\jscript9.dll 2011-09-01 05:17 . 2011-10-13 14:50 1389056 ----a-w- c:\windows\system32\wininet.dll 2011-09-01 05:12 . 2011-10-13 14:50 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2011-09-01 02:35 . 2011-10-13 14:50 1798144 ----a-w- c:\windows\SysWow64\jscript9.dll 2011-09-01 02:28 . 2011-10-13 14:50 1126912 ----a-w- c:\windows\SysWow64\wininet.dll 2011-09-01 02:22 . 2011-10-13 14:50 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb 2011-08-31 16:00 . 2010-12-04 22:00 25416 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-08-30 22:05 . 2011-08-30 22:05 96104 ----a-w- c:\windows\system32\dns-sd.exe 2011-08-30 22:05 . 2011-08-30 22:05 85864 ----a-w- c:\windows\system32\dnssd.dll 2011-08-30 22:05 . 2011-08-30 22:05 61288 ----a-w- c:\windows\system32\jdns_sd.dll 2011-08-30 22:05 . 2011-08-30 22:05 212840 ----a-w- c:\windows\system32\dnssdX.dll 2011-08-30 22:05 . 2011-08-30 22:05 83816 ----a-w- c:\windows\SysWow64\dns-sd.exe 2011-08-30 22:05 . 2011-08-30 22:05 73064 ----a-w- c:\windows\SysWow64\dnssd.dll 2011-08-30 22:05 . 2011-08-30 22:05 50536 ----a-w- c:\windows\SysWow64\jdns_sd.dll 2011-08-30 22:05 . 2011-08-30 22:05 178536 ----a-w- c:\windows\SysWow64\dnssdX.dll 2011-08-27 05:37 . 2011-10-13 10:31 861696 ----a-w- c:\windows\system32\oleaut32.dll 2011-08-27 05:37 . 2011-10-13 10:31 331776 ----a-w- c:\windows\system32\oleacc.dll 2011-08-27 04:26 . 2011-10-13 10:31 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll 2011-08-27 04:26 . 2011-10-13 10:31 233472 ----a-w- c:\windows\SysWow64\oleacc.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{974bc754-2d7b-450b-89a7-545d04f294d2}"= "c:\program files (x86)\ESPN_Cricinfo\prxtbESP0.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{974bc754-2d7b-450b-89a7-545d04f294d2}] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{974bc754-2d7b-450b-89a7-545d04f294d2}] 2011-05-09 09:49 176936 ----a-w- c:\program files (x86)\ESPN_Cricinfo\prxtbESP0.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{974bc754-2d7b-450b-89a7-545d04f294d2}"= "c:\program files (x86)\ESPN_Cricinfo\prxtbESP0.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{974bc754-2d7b-450b-89a7-545d04f294d2}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccleaner"="c:\program files\CCleaner\CCleaner64.exe" [2011-10-21 4499264] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-11-12 5495680] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "BDRegion"="c:\program files (x86)\Cyberlink\Shared files\brs.exe" [2010-06-28 75048] "IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-03 284696] "ConnectionCenter"="c:\program files (x86)\Citrix\ICA Client\concentr.exe" [2009-09-12 103768] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608] "RIMBBLaunchAgent.exe"="c:\program files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192] "NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888] "iTunesHelper"="c:\program files\ITunes\iTunesHelper.exe" [2011-11-13 421736] . c:\users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ SpywareGuard.lnk - c:\program files (x86)\SpywareGuard\sgmain.exe [2003-8-29 360448] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Hotkey.lnk - c:\program files (x86)\Hotkey\Hotkey.exe [2010-7-15 2676736] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) "EnableLinkedConnection"= 1 (0x1) "DisableCAD"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\SysWOW64\guard32.dll . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 cpuz130;cpuz130;c:\users\User\AppData\Local\Temp\cpuz130\cpuz_x64.sys [x] R3 GPU-Z;GPU-Z;c:\users\User\AppData\Local\Temp\GPU-Z.sys [x] R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x] R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x] R3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272] R3 RapportPG64;RapportPG64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [2011-09-25 61712] R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 ztemtusbser;ZTEMT Legacy Serial Communication;c:\windows\system32\DRIVERS\CT_ZTEMT_U_USBSER.sys [x] S0 pxscan;pxscan;c:\windows\System32\drivers\pxscan.sys [x] S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [x] S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [x] S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys [x] S1 pxrts;pxrts;c:\windows\system32\drivers\pxrts.sys [x] S1 RapportCerberus_32029;RapportCerberus_32029;c:\programdata\Trusteer\Rapport\store\exts\RapportCerberus\32029\RapportCerberus64_32029.sys [2011-10-20 396816] S1 RapportEI64;RapportEI64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [2011-09-25 55056] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-10-10 140672] S2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2010/12/03 16:43];c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\000.fcl [2010-06-28 22:50 146928] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952] S2 CSIScanner;CSIScanner;c:\program files\asxfkded\asxfkded.exe [2010-12-21 6724632] S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-03 13336] S2 IOCBIOS;IOCBIOS;c:\programdata\Intel\Extreme Tuning Utility\IOCbios\64bit\IOCBIOS.sys [2010-02-03 30384] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152] S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~2\mcafee\SITEAD~1\mcsacore.exe [2011-08-10 102608] S2 PowerBiosServer;PowerBiosServer;c:\program files (x86)\Hotkey\PowerBiosServer.exe [2010-06-24 32256] S2 RapportMgmtService;Rapport Management Service;c:\program files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [2011-09-25 919352] S2 UDisk Monitor;UDisk Monitor;c:\program files\MBlaze UI\bin\MonServiceUDisk.exe [2009-12-11 403456] S2 XTUService;Intel(R) Extreme Tuning Utility;c:\program files (x86)\Common Files\Intel\Intel Extreme Tuning Utility\PerfTuneService.exe [2010-02-19 22280] S3 itecir;ITECIR Infrared Receiver;c:\windows\system32\DRIVERS\itecir.sys [x] S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x] S3 JME;JMicron Ethernet Adapter NDIS6.20 Driver (Amd64 Bits);c:\windows\system32\DRIVERS\JME.sys [x] S3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 NETwNs64;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x] S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x] S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x] S3 pxkbf;pxkbf;c:\windows\system32\drivers\pxkbf.sys [x] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x] . . Contents of the 'Scheduled Tasks' folder . . --------- x86-64 ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-09-10 10867816] "BisonHK"="c:\program files (x86)\BisonCam\BisonHK.exe" [2009-11-26 86016] "DeLay"="c:\program files (x86)\BisonCam\DeLay.exe" [2008-12-05 53248] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736] "COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-10-20 9264456] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x1 "AppInit_DLLs"=c:\windows\System32\guard64.dll . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.1.1 TCP: Interfaces\{27476C53-B593-4946-A6C8-276C75130E74}: NameServer = 8.8.8.8,8.8.4.4 FF - ProfilePath - c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\jans4p9c.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - google.co.uk FF - prefs.js: keyword.URL - hxxp://uk.search.yahoo.com/search?fr=mcafee&p= FF - user.js: yahoo.ytff.general.dontshowhpoffer - true . - - - - ORPHANS REMOVED - - - - . WebBrowser-{974BC754-2D7B-450B-89A7-545D04F294D2} - (no file) HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}] "ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\000.fcl" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2011-11-17 21:00:56 ComboFix-quarantined-files.txt 2011-11-17 21:00 . Pre-Run: 438,672,482,304 bytes free Post-Run: 438,400,831,488 bytes free . - - End Of File - - 48B888B904F5C3F389F5163BBDB7E6F6