ComboFix 11-11-29.04 - Owner 12/01/2011 12:51:57.6.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2814.1983 [GMT -5:00] Running from: c:\users\Owner\Downloads\ComboFix.exe AV: AVG Anti-Virus 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Anti-Virus 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . /wow section not completed . ((((((((((((((((((((((((( Files Created from 2011-11-01 to 2011-12-01 ))))))))))))))))))))))))))))))) . . 2011-12-01 18:01 . 2011-12-01 18:35 -------- d-----w- c:\users\Owner\AppData\Local\temp 2011-12-01 18:01 . 2011-12-01 18:01 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-11-30 19:32 . 2011-11-30 19:32 -------- d-----w- c:\users\Owner\AppData\Roaming\Malwarebytes 2011-11-30 19:31 . 2011-11-30 19:31 -------- d-----w- c:\programdata\Malwarebytes 2011-11-30 19:31 . 2011-11-30 19:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-11-30 19:31 . 2011-08-31 22:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-11-29 22:59 . 2011-12-01 16:25 -------- d-----w- c:\windows\system32\drivers\AVG 2011-11-29 18:50 . 2011-11-29 18:50 -------- d-----w- c:\users\LYT 2011-11-28 21:59 . 2009-04-11 04:39 67072 ----a-w- c:\windows\system32\drivers\cdrom.sys 2011-11-28 21:08 . 2011-11-28 22:13 -------- d-----w- c:\programdata\Spybot - Search & Destroy 2011-11-28 21:08 . 2011-11-28 21:09 -------- d-----w- c:\program files\Spybot - Search & Destroy 2011-11-28 05:46 . 2011-11-29 18:41 -------- d-----w- c:\program files\Common Files\PC Tools 2011-11-28 05:45 . 2011-11-29 18:27 -------- d-----w- c:\programdata\PC Tools 2011-11-26 23:28 . 2011-11-29 21:15 -------- d-----w- c:\program files\AddThis Toolbar 2011-11-11 00:04 . 2011-10-17 11:41 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat 2011-11-11 00:04 . 2011-09-20 21:02 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys 2011-11-09 23:27 . 2011-09-30 15:57 707584 ----a-w- c:\program files\Common Files\System\wab32.dll 2011-11-09 01:22 . 2011-11-09 01:22 -------- d-----w- c:\users\Owner\AppData\Roaming\uXBzPNycADbpsd8 2011-11-09 01:22 . 2011-11-09 01:22 -------- d-----w- c:\users\Owner\AppData\Roaming\mBpJEK8gR9 2011-11-09 00:56 . 2011-11-09 00:56 -------- d-----w- c:\users\Owner\AppData\Roaming\TVrlONtxPuSiDoG 2011-11-09 00:56 . 2011-11-09 00:56 -------- d-----w- c:\users\Owner\AppData\Roaming\pQH6sWK7fLgZjCk 2011-11-09 00:51 . 2011-11-09 00:51 -------- d-----w- c:\users\Owner\AppData\Roaming\GFF44pmmG5QJ6 2011-11-09 00:51 . 2011-11-09 00:51 -------- d-----w- c:\users\Owner\AppData\Roaming\ZIIIBBtzPNyAuv2 2011-11-09 00:49 . 2011-11-09 00:49 -------- d-----w- c:\users\Owner\AppData\Roaming\ZIrONtxAuSib 2011-11-09 00:49 . 2011-11-09 00:49 -------- d-----w- c:\users\Owner\AppData\Roaming\xSibbFpn56W7fLg 2011-11-09 00:49 . 2011-11-09 01:23 -------- d-----w- c:\users\Owner\AppData\Roaming\UJJJ6ddWK8fR9hX 2011-11-09 00:49 . 2011-11-09 00:49 -------- d-----w- c:\users\Owner\AppData\Roaming\zhYYXwjUVelBzPy . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-10-07 11:23 . 2011-10-07 11:23 230608 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2011-10-04 11:21 . 2011-10-04 11:21 16720 ----a-w- c:\windows\system32\drivers\AVGIDSShim.sys 2011-09-25 05:15 . 2011-09-25 05:15 161792 ----a-w- c:\windows\system32\msls31.dll 2011-09-25 05:15 . 2011-09-25 05:15 86528 ----a-w- c:\windows\system32\iesysprep.dll 2011-09-25 05:15 . 2011-09-25 05:15 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe 2011-09-25 05:15 . 2011-09-25 05:15 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe 2011-09-25 05:15 . 2011-09-25 05:15 74752 ----a-w- c:\windows\system32\iesetup.dll 2011-09-25 05:15 . 2011-09-25 05:15 63488 ----a-w- c:\windows\system32\tdc.ocx 2011-09-25 05:15 . 2011-09-25 05:15 48640 ----a-w- c:\windows\system32\mshtmler.dll 2011-09-25 05:15 . 2011-09-25 05:15 367104 ----a-w- c:\windows\system32\html.iec 2011-09-25 05:15 . 2011-09-25 05:15 420864 ----a-w- c:\windows\system32\vbscript.dll 2011-09-25 05:15 . 2011-09-25 05:15 35840 ----a-w- c:\windows\system32\imgutil.dll 2011-09-25 05:15 . 2011-09-25 05:15 23552 ----a-w- c:\windows\system32\licmgr10.dll 2011-09-25 05:15 . 2011-09-25 05:15 152064 ----a-w- c:\windows\system32\wextract.exe 2011-09-25 05:15 . 2011-09-25 05:15 150528 ----a-w- c:\windows\system32\iexpress.exe 2011-09-25 05:15 . 2011-09-25 05:15 142848 ----a-w- c:\windows\system32\ieUnatt.exe 2011-09-25 05:15 . 2011-09-25 05:15 1427456 ----a-w- c:\windows\system32\inetcpl.cpl 2011-09-25 05:15 . 2011-09-25 05:15 11776 ----a-w- c:\windows\system32\mshta.exe 2011-09-25 05:15 . 2011-09-25 05:15 101888 ----a-w- c:\windows\system32\admparse.dll 2011-09-25 05:15 . 2011-09-25 05:15 110592 ----a-w- c:\windows\system32\IEAdvpack.dll 2011-09-25 05:08 . 2011-09-25 05:08 98816 ----a-w- c:\windows\system32\mfps.dll 2011-09-25 05:08 . 2011-09-25 05:08 979456 ----a-w- c:\windows\system32\MFH264Dec.dll 2011-09-25 05:08 . 2011-09-25 05:08 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll 2011-09-25 05:08 . 2011-09-25 05:08 302592 ----a-w- c:\windows\system32\mfmp4src.dll 2011-09-25 05:08 . 2011-09-25 05:08 2873344 ----a-w- c:\windows\system32\mf.dll 2011-09-25 05:08 . 2011-09-25 05:08 261632 ----a-w- c:\windows\system32\mfreadwrite.dll 2011-09-25 05:08 . 2011-09-25 05:08 586240 ----a-w- c:\windows\system32\stobject.dll 2011-09-25 05:08 . 2011-09-25 05:08 209920 ----a-w- c:\windows\system32\mfplat.dll 2011-09-25 05:08 . 2011-09-25 05:08 683008 ----a-w- c:\windows\system32\d2d1.dll 2011-09-25 05:08 . 2011-09-25 05:08 486400 ----a-w- c:\windows\system32\d3d10level9.dll 2011-09-25 05:08 . 2011-09-25 05:08 135680 ----a-w- c:\windows\system32\XpsRasterService.dll 2011-09-25 05:08 . 2011-09-25 05:08 1172480 ----a-w- c:\windows\system32\d3d10warp.dll 2011-09-25 05:08 . 2011-09-25 05:08 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe 2011-09-25 05:08 . 2011-09-25 05:08 638336 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys 2011-09-25 05:08 . 2011-09-25 05:08 478720 ----a-w- c:\windows\system32\dxgi.dll 2011-09-25 05:08 . 2011-09-25 05:08 37376 ----a-w- c:\windows\system32\cdd.dll 2011-09-25 05:08 . 2011-09-25 05:08 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll 2011-09-25 05:08 . 2011-09-25 05:08 258048 ----a-w- c:\windows\system32\winspool.drv 2011-09-25 05:08 . 2011-09-25 05:08 219648 ----a-w- c:\windows\system32\d3d10_1core.dll 2011-09-25 05:08 . 2011-09-25 05:08 189952 ----a-w- c:\windows\system32\d3d10core.dll 2011-09-25 05:08 . 2011-09-25 05:08 160768 ----a-w- c:\windows\system32\d3d10_1.dll 2011-09-25 05:08 . 2011-09-25 05:08 1029120 ----a-w- c:\windows\system32\d3d10.dll 2011-09-25 05:08 . 2011-09-25 05:08 847360 ----a-w- c:\windows\system32\OpcServices.dll 2011-09-25 05:08 . 2011-09-25 05:08 1554432 ----a-w- c:\windows\system32\xpsservices.dll 2011-09-25 05:07 . 2011-09-25 05:07 4096 ----a-w- c:\windows\system32\drivers\en-US\dxgkrnl.sys.mui 2011-09-25 05:07 . 2011-09-25 05:07 369664 ----a-w- c:\windows\system32\WMPhoto.dll 2011-09-25 05:07 . 2011-09-25 05:07 252928 ----a-w- c:\windows\system32\dxdiag.exe 2011-09-25 05:07 . 2011-09-25 05:07 195584 ----a-w- c:\windows\system32\dxdiagn.dll 2011-09-25 05:07 . 2011-09-25 05:07 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll 2011-09-25 05:07 . 2011-09-25 05:07 519680 ----a-w- c:\windows\system32\d3d11.dll 2011-09-25 05:07 . 2011-09-25 05:07 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll 2011-09-25 05:07 . 2011-09-25 05:07 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll 2011-09-13 11:30 . 2011-09-13 11:30 32592 ----a-w- c:\windows\system32\drivers\avgrkx86.sys 2011-09-12 23:14 . 2011-09-24 16:04 7269712 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{862B687C-897F-492F-98D2-8E7A42BAEE2C}\mpengine.dll 2011-09-06 13:30 . 2011-10-14 21:16 2043392 ----a-w- c:\windows\system32\win32k.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-08-24 1515688] . [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}] . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2011-08-24 01:20 1515688 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-08-24 1515688] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-08-24 1515688] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920] "Gadwin PrintScreen"="c:\program files\Gadwin Systems\PrintScreen\PrintScreen.exe" [2010-10-14 487424] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 1049896] "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-12-24 222504] "QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-06-12 468264] "QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-03-14 202032] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792] "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-04-15 70912] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152] "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888] "AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2011-10-25 2415456] "Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-08-31 1047208] . c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2010-12-21 227712] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk backup=c:\windows\pss\McAfee Security Scan Plus.lnk.CommonStartup backupExtension=.CommonStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApnUpdater] 2011-08-24 01:20 887976 ----a-w- c:\program files\Ask.com\Updater\Updater.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] 2008-01-21 02:25 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x] R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4640000] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] R4 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840] S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [2011-07-11 23120] S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [2011-09-13 32592] S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [2011-10-07 230608] S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2011-07-11 295248] S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248] S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [2011-08-02 192776] S2 Recovery Service for Windows;Recovery Service for Windows;c:\windows\SMINST\BLService.exe [2008-04-26 361808] S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [2011-07-11 134736] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [2011-07-11 24272] S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys [2011-10-04 16720] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-05-09 43040] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Contents of the 'Scheduled Tasks' folder . 2011-11-20 c:\windows\Tasks\HPCeeScheduleForOwner.job - c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2008-08-04 03:03] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html IE: Se&nd to OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105 LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll TCP: DhcpNameServer = 11.224.26.124 11.223.26.124 DPF: {CAFECAFE-0013-0001-0022-ABCDEFABCDEF} FF - ProfilePath - c:\users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\y61qhshs.default\ FF - prefs.js: keyword.URL - hxxp://www.tepela.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=3YzQmUJb&q= FF - prefs.js: network.proxy.type - 0 FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF - Ext: AVG Safe Search: {1E73965B-8B48-48be-9C8D-68B920ABC1C4} - c:\program files\AVG\AVG2012\Firefox4 FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b} FF - user.js: keyword.URL - hxxp://www.tepela.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=3YzQmUJb&q= . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-12-01 13:34 Windows 6.0.6002 Service Pack 2 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\cdrom] "ImagePath"="s\00y\00s\00t\00e\00m\003\002\00\\00D\00R\00I\00V\00E\00R\00S\00\\00c\00d\00r\00o\00m\00.\00s\00y\00s" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2011-12-01 13:50:15 ComboFix-quarantined-files.txt 2011-12-01 18:49 ComboFix2.txt 2011-11-29 22:32 ComboFix3.txt 2011-11-29 21:07 ComboFix4.txt 2011-11-29 15:29 . Pre-Run: 102,984,273,920 bytes free Post-Run: 102,976,479,232 bytes free . - - End Of File - - 870209C55A815F7B4F6ED82A654591C9