ComboFix 12-01-26.03 - Harsh 01/26/2012  18:04:05.1.2 - x64
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.1.1033.18.4094.2772 [GMT -5:00]
Running from: z:\users\Harsh\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
SP: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Created a new restore point
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
z:\windows\system32\java.exe
z:\windows\SysWow64\SET99C1.tmp
z:\windows\SysWow64\SET9E67.tmp
.
.
(((((((((((((((((((((((((   Files Created from 2011-12-26 to 2012-01-26  )))))))))))))))))))))))))))))))
.
.
2012-01-26 23:14 . 2012-01-26 23:14	--------	d-----w-	z:\users\Default\AppData\Local\temp
2012-01-25 04:25 . 2012-01-06 05:15	8602168	----a-w-	z:\programdata\Microsoft\Windows Defender\Definition Updates\{7BF54854-1B36-4185-BCED-1AEC636C4827}\mpengine.dll
2012-01-21 21:27 . 2012-01-02 22:15	54728	----a-w-	z:\windows\system32\drivers\Soluto.sys
2012-01-21 21:27 . 2012-01-21 21:27	--------	d-----w-	z:\program files\Soluto
2012-01-21 21:26 . 2012-01-22 19:08	--------	d-----w-	z:\programdata\Soluto
2012-01-21 21:26 . 2012-01-21 21:26	--------	d-----w-	z:\programdata\WeCareReminder
2012-01-17 19:52 . 2012-01-21 21:22	--------	d-----w-	z:\program files (x86)\Microsoft Bootvis
2012-01-15 22:45 . 2012-01-15 22:45	--------	d-----w-	z:\users\Harsh\AppData\Roaming\ImTOO
2012-01-15 22:44 . 2012-01-15 22:44	--------	d-----w-	z:\programdata\ImTOO
2012-01-15 22:44 . 2012-01-15 22:44	--------	d-----w-	z:\program files (x86)\ImTOO
2012-01-14 06:38 . 2012-01-14 06:38	--------	d-----w-	z:\windows\symbols
2012-01-14 06:38 . 2012-01-14 06:38	188128	----a-w-	z:\programdata\Microsoft\VCSExpress\10.0\1033\ResourceCache.dll
2012-01-14 06:37 . 2012-01-14 06:37	--------	d-----w-	z:\programdata\VS
2012-01-13 23:37 . 2012-01-13 23:37	--------	d-----w-	z:\programdata\Hi-Rez Studios
2012-01-13 19:13 . 2012-01-13 19:14	--------	d-----w-	z:\users\UpdatusUser
2012-01-13 19:13 . 2011-12-17 20:08	6004544	----a-w-	z:\windows\system32\nvcpl.dll
2012-01-13 19:13 . 2011-12-17 20:08	3028800	----a-w-	z:\windows\system32\nvsvc64.dll
2012-01-13 19:13 . 2011-12-17 20:08	889664	----a-w-	z:\windows\system32\nvvsvc.exe
2012-01-13 19:13 . 2011-12-17 20:08	63296	----a-w-	z:\windows\system32\nvshext.dll
2012-01-13 19:13 . 2011-12-17 20:08	2562368	----a-w-	z:\windows\system32\nvsvcr.dll
2012-01-13 19:13 . 2011-12-17 20:08	118080	----a-w-	z:\windows\system32\nvmctray.dll
2012-01-13 19:12 . 2012-01-13 19:12	--------	d-----w-	z:\programdata\NVIDIA Corporation
2012-01-03 13:10 . 2012-01-03 13:10	182672	----a-w-	z:\program files (x86)\Mozilla Firefox\plugins\nppdf32.dll
2012-01-03 13:10 . 2012-01-03 13:10	182672	----a-w-	z:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-26 23:16 . 2010-11-25 05:08	25640	----a-w-	z:\windows\gdrv.sys
2011-12-21 01:48 . 2011-11-21 00:46	417440	----a-w-	z:\windows\SysWow64\FlashPlayerApp.exe
2011-12-21 01:48 . 2011-09-07 00:10	70304	----a-w-	z:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-12-21 01:48 . 2011-11-21 00:48	8783008	----a-w-	z:\windows\SysWow64\FlashPlayerInstaller.exe
2011-12-18 16:49 . 2010-08-28 03:03	271200	----a-w-	z:\windows\SysWow64\PnkBstrB.xtr
2011-12-18 16:49 . 2010-08-28 03:03	271200	----a-w-	z:\windows\SysWow64\PnkBstrB.exe
2011-12-15 04:39 . 2011-12-15 04:39	42392	----a-w-	z:\windows\SysWow64\xfcodec.dll
2011-12-15 04:39 . 2011-12-15 04:39	28056	----a-w-	z:\windows\system32\xfcodec64.dll
2011-12-10 20:24 . 2010-08-27 22:21	23152	----a-w-	z:\windows\system32\drivers\mbam.sys
2011-12-09 20:49 . 2010-08-28 03:03	271200	----a-w-	z:\windows\SysWow64\PnkBstrB.ex0
2011-11-27 05:38 . 2011-11-27 05:38	923416	----a-r-	z:\users\Harsh\AppData\Roaming\Microsoft\Installer\{7AAA27E4-CDB3-49C0-AA2D-41827C001BA3}\StartMenuIcon.exe
2011-11-24 04:52 . 2011-12-13 22:41	3145216	----a-w-	z:\windows\system32\win32k.sys
2011-11-21 01:19 . 2010-11-27 20:52	25640	----a-w-	z:\windows\etdrv.sys
2011-11-21 01:13 . 2010-11-27 20:52	30528	----a-w-	z:\windows\GVTDrv64.sys
2011-11-21 00:36 . 2011-11-21 00:36	627600	----a-w-	z:\windows\system32\deployJava1.dll
2011-11-15 19:29 . 2010-08-27 20:11	270720	------w-	z:\windows\system32\MpSigStub.exe
2011-11-05 05:32 . 2011-12-13 22:41	2048	----a-w-	z:\windows\system32\tzres.dll
2011-11-05 04:26 . 2011-12-13 22:41	2048	----a-w-	z:\windows\SysWow64\tzres.dll
2011-11-04 01:53 . 2011-12-13 23:18	2309120	----a-w-	z:\windows\system32\jscript9.dll
2011-11-04 01:44 . 2011-12-13 23:18	1390080	----a-w-	z:\windows\system32\wininet.dll
2011-11-04 01:44 . 2011-12-13 23:18	1493504	----a-w-	z:\windows\system32\inetcpl.cpl
2011-11-04 01:34 . 2011-12-13 23:18	2382848	----a-w-	z:\windows\system32\mshtml.tlb
2011-11-03 22:47 . 2011-12-13 23:18	1798144	----a-w-	z:\windows\SysWow64\jscript9.dll
2011-11-03 22:40 . 2011-12-13 23:18	1427456	----a-w-	z:\windows\SysWow64\inetcpl.cpl
2011-11-03 22:39 . 2011-12-13 23:18	1127424	----a-w-	z:\windows\SysWow64\wininet.dll
2011-11-03 22:31 . 2011-12-13 23:18	2382848	----a-w-	z:\windows\SysWow64\mshtml.tlb
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17	94208	----a-w-	z:\users\Harsh\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17	94208	----a-w-	z:\users\Harsh\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17	94208	----a-w-	z:\users\Harsh\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17	94208	----a-w-	z:\users\Harsh\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PeerBlock"="z:\program files\PeerBlock\peerblock.exe" [2010-11-07 2646128]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"DeathAdder"="z:\program files (x86)\Razer\DeathAdder\razerhid.exe" [2010-05-05 251392]
.
z:\users\Harsh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk.disabled [2011-12-11 990]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SolutoService]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="z:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher"="z:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"iTunesHelper"="z:\program files (x86)\iTunes\iTunesHelper.exe"
"SunJavaUpdateSched"="z:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"DivXUpdate"="z:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"GrooveMonitor"="z:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
"QuickTime Task"="z:\program files (x86)\QuickTime\QTTask.exe" -atboottime
"AppleSyncNotifier"=z:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
"APSDaemon"="z:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"googletalk"=z:\program files (x86)\Google\Google Talk\googletalk.exe /autostart
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;z:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;z:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 cpuz134;cpuz134;z:\windows\system32\drivers\cpuz134_x64.sys [x]
R3 AdobeARMservice;Adobe Acrobat Update Service;z:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;z:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2011-12-21 253600]
R3 Akamai;Akamai NetSession Interface;z:\windows\System32\svchost.exe [2009-07-14 27136]
R3 cpudrv64;cpudrv64;z:\program files (x86)\SystemRequirementsLab\cpudrv64.sys [2009-12-18 17864]
R3 cpuz135;cpuz135;z:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]
R3 DrvAgent64;DrvAgent64;z:\windows\SysWOW64\Drivers\DrvAgent64.SYS [2011-10-26 21712]
R3 EagleX64;EagleX64;z:\windows\system32\drivers\EagleX64.sys [x]
R3 etdrv;etdrv;z:\windows\etdrv.sys [2011-11-21 25640]
R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;z:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [2011-03-01 130976]
R3 gupdate;Google Update Service (gupdate);z:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-27 136176]
R3 gupdatem;Google Update Service (gupdatem);z:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-27 136176]
R3 GVTDrv64;GVTDrv64;z:\windows\GVTDrv64.sys [2011-11-21 30528]
R3 HiPatchService;Hi-Rez Studios Authenticate and Update Service;g:\games\Hi-Rez Studios\HiPatchService.exe [2012-01-17 8704]
R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;z:\windows\system32\drivers\LGVirHid.sys [x]
R3 NLNdisPT;NetLimiter Ndis Protocol Service;z:\windows\system32\DRIVERS\nlndis.sys [x]
R3 pwdrvio;pwdrvio;z:\windows\system32\pwdrvio.sys [x]
R3 pwdspio;pwdspio;z:\windows\system32\pwdspio.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;z:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 RivaTuner64;RivaTuner64;z:\program files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys [2010-11-27 19952]
R3 SBSDWSCService;SBSD Security Center Service;z:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R3 Synth3dVsc;Synth3dVsc;z:\windows\system32\drivers\synth3dvsc.sys [x]
R3 teamviewervpn;TeamViewer VPN Adapter;z:\windows\system32\DRIVERS\teamviewervpn.sys [x]
R3 TsUsbFlt;TsUsbFlt;z:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;z:\windows\system32\drivers\tsusbhub.sys [x]
R3 TunngleService;TunngleService;z:\program files (x86)\Tunngle\TnglCtrl.exe [2011-10-14 745832]
R3 VGPU;VGPU;z:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;z:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 Soluto;Soluto;z:\windows\system32\DRIVERS\Soluto.sys [x]
S0 sptd;sptd;z:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 ehdrv;ehdrv;z:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 nltdi;nltdi;z:\program files\NetLimiter 3\nltdi.sys [2011-03-21 88200]
S1 SASDIFSV;SASDIFSV;z:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
S1 SASKUTIL;SASKUTIL;z:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
S2 !SASCORE;SAS Core Service;z:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672]
S2 ekrn;ESET Service;z:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2009-09-29 735960]
S2 epfwwfpr;epfwwfpr;z:\windows\system32\DRIVERS\epfwwfpr.sys [x]
S2 GEST Service;GEST Service for program management.;z:\program files (x86)\GIGABYTE\EnergySaver\GSvr.exe [2009-12-03 68136]
S2 nvUpdatusService;NVIDIA Update Service Daemon;z:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2011-12-17 2348864]
S2 SolutoService;Soluto PCGenome Core Service;z:\program files\Soluto\SolutoService.exe [2012-01-02 515104]
S3 DAdderFltr;DeathAdder Mouse;z:\windows\system32\drivers\dadder.sys [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;z:\windows\system32\drivers\LGBusEnum.sys [x]
S3 NLNdisMP;NLNdisMP;z:\windows\system32\DRIVERS\nlndis.sys [x]
S3 pbfilter;pbfilter;z:\program files\PeerBlock\pbfilter.sys [2010-11-07 24176]
S3 RTL8167;Realtek 8167 NT Driver;z:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);z:\windows\system32\DRIVERS\tap0901t.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - PBFILTER
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai	REG_MULTI_SZ   	Akamai
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-06-17 16:11	451872	----a-w-	z:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-26 z:\windows\Tasks\Adobe Flash Player Updater.job
- z:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2011-11-21 01:48]
.
2012-01-13 z:\windows\Tasks\Google Software Updater.job
- z:\program files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-08-27 21:30]
.
2012-01-23 z:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- z:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-27 21:36]
.
2012-01-26 z:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- z:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-27 21:36]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17	97792	----a-w-	z:\users\Harsh\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17	97792	----a-w-	z:\users\Harsh\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17	97792	----a-w-	z:\users\Harsh\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17	97792	----a-w-	z:\users\Harsh\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="z:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-09-03 11464296]
"egui"="z:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-09-29 2716216]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uLocal Page = z:\windows\system32\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Download with pod-works-platinum - z:\program files (x86)\ImTOO\PodWorks Platinum\upod_link.HTM
IE: E&xport to Microsoft Excel - z:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - z:\users\Harsh\AppData\Roaming\Mozilla\Firefox\Profiles\vk995pnm.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.gamespot.com
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(yahoo.homepage.dontask, true);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{7aeb3efd-e564-43f1-b658-5058a7c5743b} - (no file)
AddRemove-CoreAAC Audio Decoder - z:\windows\system32\CoreAAC-uninstall.exe
AddRemove-Microsoft Visual C# 2010 Express - ENU - e:\program files (x86)\Microsoft Visual Studio 10.0\Microsoft Visual C# 2010 Express - ENU\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]
"ServiceDll"="z:\program files (x86)\common files\akamai/netsession_win_b427739.dll"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@z:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_160_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="z:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_160_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="z:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_160.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="z:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_160.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="z:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_160.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="z:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_160.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info]
@Denied: (2) (LocalSystem)
@SACL=
"AppDataDir"="z:\\ProgramData\\ESET\\ESET NOD32 Antivirus\\"
"DataDir"="ESET\\ESET NOD32 Antivirus\\"
"EditionName"=" "
"InstallDir"="z:\\Program Files\\ESET\\ESET NOD32 Antivirus\\"
"LanguageId"=dword:00000409
"PackageTag"=dword:6090e758
"ProductBase"=dword:00000000
"ProductCode"="{4183655A-5FC6-4A23-A804-7764145EC57C}"
"ProductName"="ESET NOD32 Antivirus"
"ProductType"="eav"
"ProductVersion"="4.0.468.0"
"UniqueId"="000941434D8D8E3F"
"ScannerBuild"=dword:00002304
"ScannerVersionId"=dword:00001764
"ScannerVersion"="Locked/open ESET for status."
"FixId"=dword:00000009
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
z:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
z:\program files (x86)\Razer\DeathAdder\razerofa.exe
.
**************************************************************************
.
Completion time: 2012-01-26  18:20:27 - machine was rebooted
ComboFix-quarantined-files.txt  2012-01-26 23:20
.
Pre-Run: 2,000,457,728 bytes free
Post-Run: 6,223,572,992 bytes free
.
- - End Of File - - 1728D0319CA95F6AF4E898F23C219073