Hi.
There was no error when i merged the registry.
The other error was "Windows cannot find HKEY_LOCAL_MACHINE\System\CurrentControlSet\RPCSS" "C:\Documents.Make sure you typed the name correctly"
Here is the log
ComboFix 10-09-27.04 - RYAN 10/05/2010 21:41:52.2.2 - x86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\RYAN\Desktop\CFScript.txt
.
- REDUCED FUNCTIONALITY MODE -
file zipped: c:\program files\Common Files\agepubiva.pif
file zipped: c:\program files\Common Files\evamewu.com
file zipped: c:\program files\Common Files\wapykysal.vbs
file zipped: c:\program files\Common Files\wovyw.db
file zipped: c:\windows\system32\drivers\NETwLx32.sys
file zipped: c:\windows\system32\NETwLc32.dll
file zipped: c:\windows\system32\NETwLr32.dll
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Common Files\agepubiva.pif
c:\program files\Common Files\evamewu.com
c:\program files\Common Files\wapykysal.vbs
c:\program files\Common Files\wovyw.db
c:\windows\system32\drivers\NETwLx32.sys
c:\windows\system32\NETwLc32.dll
c:\windows\system32\NETwLr32.dll
.
((((((((((((((((((((((((( Files Created from 2010-09-05 to 2010-10-05 )))))))))))))))))))))))))))))))
.
2010-09-29 03:17 . 2010-09-29 03:17 ——– d—–w- c:\program files\YourWare Solutions
2010-09-29 01:31 . 2010-09-29 01:31 ——– d—–w- c:\program files\CCleaner
2010-09-29 00:41 . 2009-10-26 13:47 4221952 —-a-w- c:\windows\system32\drivers\NETw5x32.sys
2010-09-29 00:41 . 2008-06-20 17:33 2756608 —-a-w- c:\windows\system32\NETw5r32.dll
2010-09-29 00:41 . 2008-06-20 17:32 663552 —-a-w- c:\windows\system32\NETw5c32.dll
2010-09-28 12:36 . 2010-09-28 12:41 ——– d—–w- c:\program files\RegistryFix
2010-09-28 12:03 . 2010-09-28 12:03 ——– d—–w- c:\documents and settings\RYAN\Application Data\IObit
2010-09-28 12:03 . 2010-09-28 12:03 ——– d—–w- c:\program files\IObit
2010-09-28 11:28 . 2010-09-28 12:24 ——– d—–w- c:\documents and settings\RYAN\Local Settings\Application Data\Promosoft Corporation
2010-09-28 11:28 . 2010-09-28 12:25 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-09-28 09:30 . 2010-04-29 05:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-28 09:30 . 2010-04-29 05:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-09-28 01:29 . 2010-09-28 01:29 ——– d—–w- c:\documents and settings\All Users\Application Data\Installations
2010-09-28 00:30 . 2010-09-29 04:11 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-09-26 11:14 . 2010-09-26 11:14 ——– d—–w- c:\program files\Trend Micro
2010-09-24 22:52 . 2009-02-17 10:34 112640 —-a-w- c:\windows\system32\drivers\ewusbnet.sys
2010-09-24 22:52 . 2008-12-30 01:55 102656 —-a-w- c:\windows\system32\drivers\ewusbfake.sys
2010-09-24 22:52 . 2008-12-13 01:26 102400 —-a-w- c:\windows\system32\drivers\ewusbmdm.sys
2010-09-24 22:52 . 2008-04-13 23:36 621056 —-a-w- c:\windows\system32\drivers\mod7700.sys
2010-09-24 22:52 . 2007-08-08 18:13 24448 —-a-w- c:\windows\system32\drivers\ewdcsc.sys
2010-09-24 06:04 . 2010-09-24 06:04 ——– d—–w- c:\program files\Wireless Broadband
2010-09-23 14:46 . 2010-09-23 14:46 ——– d–h–w- c:\windows\system32\GroupPolicy
2010-09-23 14:27 . 2010-09-23 15:08 ——– d—–w- c:\documents and settings\All Users\Application Data\nView_Profiles
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-05 10:42 . 2007-01-02 18:56 ——– d—–w- c:\program files\Unwired
2010-10-05 10:36 . 2009-10-05 01:06 ——– d—–w- c:\documents and settings\RYAN\Application Data\uTorrent
2010-09-29 01:43 . 2009-12-09 06:40 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-08-07 07:27 . 2010-08-04 08:15 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-08-04 08:16 . 2010-08-04 08:15 2605008 —-a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe
.
——- Sigcheck ——-
Cryptography Services Error !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 65536]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-10-05 289072]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-09-10 2424560]
"FreeRAM XP"="c:\program files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" [2006-03-22 1591808]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2005-10-14 88203]
"RTHDCPL"="RTHDCPL.EXE" [2005-12-09 15691264]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-10-06 122940]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-27 122880]
"Tvs"="c:\program files\Toshiba\Tvs\TvsTray.exe" [2005-11-30 73728]
"THotkey"="c:\program files\Toshiba\Toshiba Applet\thotkey.exe" [2006-01-05 352256]
"TDispVol"="TDispVol.exe" [2005-03-11 73728]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-02 761948]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-05 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 602182]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-01 7557120]
"nwiz"="nwiz.exe" [2006-05-01 1519616]
"NVRotateSysTray"="c:\windows\system32\nvsysrot.dll" [2006-05-01 49152]
"PSQLLauncher"="c:\program files\Protector Suite QL\launcher.exe" [2006-05-05 30208]
"TPSMain"="TPSMain.exe" [2005-05-31 282624]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-12-18 98304]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-09 144784]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2006-05-05 06:48 40448 —-a-w- c:\windows\system32\psqlpwd.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli psqlpwd
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Unwired\\UwWiz.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"=
"c:\\Program Files\\TOSHIBA\\ConfigFree\\CFXFER.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2010-02-17 12872]
S0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\System32\drivers\sfsync03.sys [2005-12-06 35328]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S2 FdRedir;FdRedir;c:\program files\Common Files\Protector Suite QL\Drivers\FdRedir.sys [2006-05-05 13568]
S2 FileDisk2;FileDisk Protector Kernel Driver;c:\program files\Common Files\Protector Suite QL\Drivers\filedisk.sys [2006-05-05 33024]
S2 smihlp;SMI helper driver;c:\program files\Protector Suite QL\smihlp.sys [2006-05-05 3456]
.
Contents of the 'Scheduled Tasks' folder
2010-09-20 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-05-04 12:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com.au/
uInternet Connection Wizard,ShellNext = hxxp://www.unwired.com.au/
uInternet Settings,ProxyOverride =
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2010-10-05 21:45
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
@DACL=(02 0000)
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
@DACL=(02 0000)
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
@DACL=(02 0000)
"Installed"="1"
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(1188)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\psqlpwd.dll
c:\program files\Protector Suite QL\infra.dll
c:\program files\Protector Suite QL\homefus2.dll
c:\windows\system32\biologon.dll
c:\program files\Protector Suite QL\homepass.dll
c:\program files\Protector Suite QL\bio.dll
c:\program files\Protector Suite QL\crypto.dll
c:\program files\Protector Suite QL\remote.dll
c:\program files\Protector Suite QL\mysafe.dll
- - - - - - - > 'lsass.exe'(1244)
c:\windows\system32\psqlpwd.dll
c:\program files\Protector Suite QL\infra.dll
c:\program files\Protector Suite QL\homefus2.dll
.
Completion time: 2010-10-05 21:51:47
ComboFix-quarantined-files.txt 2010-10-05 10:50
ComboFix2.txt 2010-09-28 02:11
Pre-Run: 77,576,253,440 bytes free
Post-Run: 77,554,872,320 bytes free
- - End Of File - - 00881891B60E19CE40598F32FA4A3B7B