API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Jul 28th, 2017
353
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 22.16 KB | None | 0 0
raw download clone embed print report
  1. ComboFix 11-02-24.01 - Bradley 02/24/2011 13:54:44.1.2 - x64
  2. Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3999.2345 [GMT -6:00]
  3. Running from: c:\users\Bradley\Desktop\ComboFix.exe
  4. AV: avast! Antivirus *Disabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
  5. AV: Norton Internet Security *Disabled/Outdated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
  6. FW: Norton Internet Security *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}
  7. SP: avast! Antivirus *Disabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
  8. SP: Norton Internet Security *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
  9. SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
  10. * Created a new restore point
  11. .
  12.  
  13. ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
  14. .
  15.  
  16. c:\users\Bradley\AppData\Local\CrashGate.exe
  17. c:\users\Bradley\AppData\Local\Twain.dll
  18. c:\users\Bradley\AppData\Roaming\CrashGate.exe
  19. c:\users\Bradley\AppData\Roaming\Twain.dll
  20. C:\Windupdt
  21.  
  22. .
  23. ((((((((((((((((((((((((( Files Created from 2011-01-24 to 2011-02-24 )))))))))))))))))))))))))))))))
  24. .
  25.  
  26. 2011-02-24 20:03 . 2011-02-24 20:03 -------- d-----w- c:\users\Default\AppData\Local\temp
  27. 2011-02-22 17:40 . 2011-01-13 10:20 7844688 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{54070D1F-054B-4355-BC27-184A4D9386B1}\mpengine.dll
  28. 2011-02-18 01:46 . 2011-02-18 01:46 -------- d-----w- c:\users\Bradley\AppData\Local\XYZ_Logger_v2
  29. 2011-02-11 01:37 . 2011-02-11 01:37 -------- d-----w- c:\program files (x86)\proXPN
  30. 2011-02-10 17:14 . 2011-02-10 17:14 -------- d-----w- c:\program files\iTunes
  31. 2011-02-10 17:14 . 2011-02-10 17:14 -------- d-----w- c:\program files\iPod
  32. 2011-02-09 18:55 . 2010-12-18 06:15 1197056 ----a-w- c:\windows\system32\wininet.dll
  33. 2011-02-09 18:55 . 2010-12-18 05:32 981504 ----a-w- c:\windows\SysWow64\wininet.dll
  34. 2011-02-09 18:55 . 2010-12-18 05:29 860160 ----a-w- c:\program files (x86)\Internet Explorer\iedvtool.dll
  35. 2011-02-09 18:52 . 2011-01-07 08:06 46080 ----a-w- c:\windows\system32\atmlib.dll
  36. 2011-02-09 18:52 . 2011-01-07 07:27 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
  37. 2011-02-09 18:52 . 2011-01-07 05:49 366080 ----a-w- c:\windows\system32\atmfd.dll
  38. 2011-02-09 18:52 . 2011-01-07 05:33 294400 ----a-w- c:\windows\SysWow64\atmfd.dll
  39. 2011-02-09 02:44 . 2011-02-09 02:44 -------- d-----w- c:\users\Bradley\AppData\Roaming\RealHideIP
  40. 2011-02-09 02:44 . 2011-02-09 02:44 -------- d-----w- c:\programdata\RealHideIP
  41. 2011-02-09 02:44 . 2011-02-09 02:44 -------- d-----w- c:\program files (x86)\RealHideIP
  42. 2011-02-05 18:51 . 2011-02-05 18:51 -------- d-----w- C:\Intel
  43. 2011-02-04 17:06 . 2011-02-09 21:41 -------- d-----w- C:\.jagex_cache_32
  44. 2011-02-02 04:34 . 2011-02-21 18:26 -------- d-----w- c:\users\Bradley\AppData\Roaming\TeamViewer
  45. 2011-01-31 03:06 . 2011-01-31 03:06 -------- d-----w- c:\program files (x86)\Conduit
  46. 2011-01-31 03:06 . 2011-01-31 03:06 -------- d-----w- c:\program files (x86)\uTorrentBar
  47. 2011-01-30 21:31 . 2011-01-30 21:31 -------- d-----w- c:\users\Bradley\AppData\Roaming\Malwarebytes
  48. 2011-01-30 21:31 . 2010-12-21 00:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
  49. 2011-01-30 21:31 . 2011-01-30 21:31 -------- d-----w- c:\programdata\Malwarebytes
  50. 2011-01-30 21:31 . 2011-01-30 21:31 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
  51. 2011-01-30 21:31 . 2010-12-21 00:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
  52. 2011-01-30 04:43 . 2011-01-30 04:43 -------- d-----w- c:\program files (x86)\TeamViewer
  53. 2011-01-30 04:13 . 2011-01-30 04:13 -------- d-----r- C:\Sandbox
  54. 2011-01-30 04:10 . 2011-01-30 04:10 -------- d-----w- c:\program files\Sandboxie
  55. 2011-01-30 01:09 . 2011-01-30 01:09 -------- d-----w- c:\users\Bradley\AppData\Local\Vitalwerks
  56. 2011-01-30 01:08 . 2011-01-30 01:08 -------- d-----w- c:\program files (x86)\No-IP
  57. 2011-01-29 20:20 . 2011-01-29 20:20 -------- d-----w- c:\program files\CCleaner
  58. 2011-01-29 19:09 . 2011-01-13 08:37 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
  59. 2011-01-29 19:09 . 2011-01-13 08:41 273488 ----a-w- c:\windows\system32\drivers\aswSP.sys
  60. 2011-01-29 19:09 . 2011-01-13 08:37 29264 ----a-w- c:\windows\system32\drivers\aswRdr.sys
  61. 2011-01-29 19:09 . 2011-01-13 08:40 51792 ----a-w- c:\windows\system32\drivers\aswTdi.sys
  62. 2011-01-29 19:08 . 2011-01-13 08:37 62032 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
  63. 2011-01-29 19:08 . 2011-01-13 08:47 237168 ----a-w- c:\windows\system32\aswBoot.exe
  64. 2011-01-29 19:07 . 2011-01-13 08:47 38848 ----a-w- c:\windows\avastSS.scr
  65. 2011-01-29 19:07 . 2011-01-13 08:47 188216 ----a-w- c:\windows\SysWow64\aswBoot.exe
  66. 2011-01-29 19:07 . 2011-01-29 19:07 -------- d-----w- c:\programdata\Alwil Software
  67. 2011-01-29 19:07 . 2011-01-29 19:07 -------- d-----w- c:\program files\Alwil Software
  68. 2011-01-29 19:01 . 2011-01-30 20:51 -------- d-----w- c:\programdata\Spybot - Search & Destroy
  69. 2011-01-29 19:01 . 2011-01-29 19:01 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
  70.  
  71. .
  72. (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  73. .
  74. 2011-01-18 03:57 . 2011-01-18 03:57 40128 ----a-w- c:\windows\system32\drivers\tap0901.sys
  75. 2010-11-29 23:38 . 2010-11-29 23:38 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
  76. 2010-11-29 23:38 . 2010-11-29 23:38 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
  77. .
  78.  
  79. ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  80. .
  81. .
  82. *Note* empty entries & legit default entries are not shown
  83. REGEDIT4
  84.  
  85. [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
  86. 2010-12-09 18:51 3911776 ----a-w- c:\program files (x86)\ConduitEngine\ConduitEngine.dll
  87.  
  88. [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{ABD3B5E1-B268-407B-A150-2641DAB8D898}]
  89. 2009-06-08 21:41 120104 ----a-w- c:\program files (x86)\Common Files\Homepage Protection\HomepageProtection.dll
  90.  
  91. [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
  92. 2010-12-09 18:51 3911776 ----a-w- c:\program files (x86)\uTorrentBar\tbuTor.dll
  93.  
  94. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
  95. "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files (x86)\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]
  96. "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files (x86)\ConduitEngine\ConduitEngine.dll" [2010-12-09 3911776]
  97.  
  98. [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
  99.  
  100. [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
  101.  
  102. [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  103. "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-06-17 2363392]
  104. "Google Update"="c:\users\Bradley\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-10-01 136176]
  105. "msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-09-23 4240760]
  106. "SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
  107.  
  108. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
  109. "QPService"="c:\program files (x86)\HP\QuickPlay\QPService.exe" [2009-06-24 468264]
  110. "QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-06-24 320056]
  111. "NortonOnlineBackupReminder"="c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-05-13 581480]
  112. "UpdatePRCShortCut"="c:\program files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
  113. "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
  114. "HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
  115. "WirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]
  116. "UCam_Menu"="c:\program files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-02-18 218408]
  117. "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
  118. "AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
  119. "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
  120. "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
  121. "AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-14 47904]
  122. "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-12-21 443728]
  123. "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-01-25 421160]
  124.  
  125. c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
  126. Kaspersky Security Scan.lnk - c:\program files (x86)\Kaspersky Security Scan\KSS.exe [2010-9-3 2402696]
  127.  
  128. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
  129. "ConsentPromptBehaviorAdmin"= 5 (0x5)
  130. "ConsentPromptBehaviorUser"= 3 (0x3)
  131. "EnableUIADesktopToggle"= 0 (0x0)
  132.  
  133. [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
  134. "WallpaperStyle"= 2
  135.  
  136. [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
  137. Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
  138.  
  139. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
  140. @="FSFilter Activity Monitor"
  141.  
  142. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
  143. @="Driver"
  144.  
  145. R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-01 136176]
  146. R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2010-12-21 363344]
  147. R3 NETw1v64;Intel(R) Wireless WiFi Link 1000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\NETw1v64.sys [2009-07-20 7058432]
  148. R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]
  149. R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-06-24 216576]
  150. R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
  151. R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
  152. R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
  153. R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
  154. R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
  155. R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\System32\Drivers\NISx64\1008000.029\SYMNDISV.SYS [2009-08-15 56880]
  156. R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2010-09-28 51712]
  157. R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-10-01 1255736]
  158. R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120]
  159. R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
  160. S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1008000.029\SYMEFA64.SYS [2009-08-15 402992]
  161. S1 aswSP;aswSP; [x]
  162. S1 BHDrvx64;Symantec Heuristics Driver;c:\windows\System32\Drivers\NISx64\1008000.029\BHDrvx64.sys [2010-01-20 334384]
  163. S1 ccHP;Symantec Hash Provider;c:\windows\System32\Drivers\NISx64\1008000.029\ccHPx64.sys [2010-10-01 583296]
  164. S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20101129.001\IDSvia64.sys [2010-10-19 476720]
  165. S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
  166. S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe [2009-03-02 89600]
  167. S2 aswFsBlk;aswFsBlk; [x]
  168. S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-01-13 62032]
  169. S2 Norton Internet Security;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe [2009-08-15 117640]
  170. S2 RosettaStoneLtdController;RosettaStoneLtdController;c:\program files (x86)\RosettaStoneLtdServices\RosettaStoneLtdController.exe [2008-09-16 352312]
  171. S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
  172. S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-01-27 2253688]
  173. S3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-05-05 228408]
  174. S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-05-26 138752]
  175. S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-12-21 24152]
  176. S3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [2010-01-13 7675392]
  177. S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-05-22 215040]
  178.  
  179.  
  180. [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
  181. 2009-06-17 19:11 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
  182. .
  183. Contents of the 'Scheduled Tasks' folder
  184.  
  185. 2011-02-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
  186. - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-12 14:41]
  187.  
  188. 2011-02-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
  189. - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-12 14:41]
  190.  
  191. 2011-02-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3736923637-2607696319-2159169609-1000Core.job
  192. - c:\users\Bradley\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-01 14:41]
  193.  
  194. 2011-02-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3736923637-2607696319-2159169609-1000UA.job
  195. - c:\users\Bradley\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-01 14:41]
  196.  
  197. 2011-02-06 c:\windows\Tasks\HPCeeScheduleForBradley.job
  198. - c:\program files (x86)\hewlett-packard\sdp\ceement\HPCEE.exe [2009-08-15 21:38]
  199. .
  200.  
  201. --------- x86-64 -----------
  202.  
  203.  
  204. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  205. "SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2009-07-22 450048]
  206. "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-15 171520]
  207. "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
  208. "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 161304]
  209. "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 386584]
  210. "Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 415256]
  211.  
  212. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  213. "LoadAppInit_DLLs"=0x0
  214. .
  215. ------- Supplementary Scan -------
  216. .
  217. uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_US&c=94&bd=Pavilion&pf=cnnb
  218. uLocal Page = c:\windows\system32\blank.htm
  219. uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_US&c=94&bd=Pavilion&pf=cnnb
  220. mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_US&c=94&bd=Pavilion&pf=cnnb
  221. mLocal Page = c:\windows\SysWOW64\blank.htm
  222. uInternet Settings,ProxyServer = http=;ftp=;https=;
  223. FF - ProfilePath - c:\users\Bradley\AppData\Roaming\Mozilla\Firefox\Profiles\jnzk165t.default\
  224. FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}
  225. FF - prefs.js: browser.search.selectedEngine -
  226. FF - prefs.js: network.proxy.ftp - 127.0.0.1
  227. FF - prefs.js: network.proxy.ftp_port - 8080
  228. FF - prefs.js: network.proxy.gopher - 5.6.7.8
  229. FF - prefs.js: network.proxy.gopher_port - 8080
  230. FF - prefs.js: network.proxy.http - 127.0.0.1
  231. FF - prefs.js: network.proxy.http_port - 8080
  232. FF - prefs.js: network.proxy.socks - 127.0.0.1
  233. FF - prefs.js: network.proxy.socks_port - 1080
  234. FF - prefs.js: network.proxy.ssl_port - 8080
  235. FF - prefs.js: network.proxy.type - 0
  236. FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
  237. FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
  238. FF - Ext: HP Smart Web Printing: smartwebprinting@hp.com - c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
  239. FF - Ext: Norton Toolbar: {7BA52691-1876-45ce-9EE6-54BCB3B04BBC} - c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn
  240. FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
  241. FF - Ext: uTorrentBar Community Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - %profile%\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
  242. .
  243. - - - - ORPHANS REMOVED - - - -
  244.  
  245. Wow6432Node-HKCU-Run-AdobeBridge - (no file)
  246. WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
  247. HKLM-Run-SynTPEnh - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
  248.  
  249.  
  250.  
  251. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Norton Internet Security]
  252. "ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files (x86)\Norton Internet Security\Engine\16.8.0.41\diMaster.dll\" /prefetch:1"
  253. .
  254. --------------------- LOCKED REGISTRY KEYS ---------------------
  255.  
  256. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
  257. @Denied: (A 2) (Everyone)
  258. @="FlashBroker"
  259. "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10b.exe,-101"
  260.  
  261. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
  262. "Enabled"=dword:00000001
  263.  
  264. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
  265. @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10b.exe"
  266.  
  267. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
  268. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  269.  
  270. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
  271. @Denied: (A 2) (Everyone)
  272. @="Shockwave Flash Object"
  273.  
  274. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
  275. @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
  276. "ThreadingModel"="Apartment"
  277.  
  278. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
  279. @="0"
  280.  
  281. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
  282. @="ShockwaveFlash.ShockwaveFlash.10"
  283.  
  284. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  285. @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
  286.  
  287. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
  288. @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
  289.  
  290. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
  291. @="1.0"
  292.  
  293. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  294. @="ShockwaveFlash.ShockwaveFlash"
  295.  
  296. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
  297. @Denied: (A 2) (Everyone)
  298. @="Macromedia Flash Factory Object"
  299.  
  300. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
  301. @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
  302. "ThreadingModel"="Apartment"
  303.  
  304. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
  305. @="FlashFactory.FlashFactory.1"
  306.  
  307. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  308. @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
  309.  
  310. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
  311. @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
  312.  
  313. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
  314. @="1.0"
  315.  
  316. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  317. @="FlashFactory.FlashFactory"
  318.  
  319. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
  320. @Denied: (A 2) (Everyone)
  321. @="IFlashBroker2"
  322.  
  323. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
  324. @="{00020424-0000-0000-C000-000000000046}"
  325.  
  326. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
  327. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  328. "Version"="1.0"
  329.  
  330. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
  331. @Denied: (A) (Users)
  332. @Denied: (A) (Everyone)
  333. @Allowed: (B 1 2 3 4 5) (S-1-5-20)
  334. "BlindDial"=dword:00000000
  335. "MSCurrentCountry"=dword:000000b5
  336.  
  337. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
  338. @Denied: (Full) (Everyone)
  339. .
  340. ------------------------ Other Running Processes ------------------------
  341. .
  342. c:\program files\Alwil Software\Avast5\AvastSvc.exe
  343. c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
  344. c:\program files (x86)\Bonjour\mDNSResponder.exe
  345. c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
  346. c:\program files (x86)\CyberLink\Shared files\RichVideo.exe
  347. c:\program files (x86)\RosettaStoneLtdServices\RosettaStoneLtdServer.exe
  348. c:\program files (x86)\TeamViewer\Version6\TeamViewer.exe
  349. c:\program files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
  350. .
  351. **************************************************************************
  352. .
  353. Completion time: 2011-02-24 14:11:46 - machine was rebooted
  354. ComboFix-quarantined-files.txt 2011-02-24 20:11
  355.  
  356. Pre-Run: 225,790,189,568 bytes free
  357. Post-Run: 225,347,567,616 bytes free
  358.  
  359. - - End Of File - - 5C8FD24FCF8CC4B660BD4A9F6B710B60
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!