liaml
I finally got combofix to run. And my computer appears to be fine now.
Heres the combofix log:
ComboFix 12-05-25.03 - Liam 26/05/2012 14:21:55.2.4 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.61.1033.18.2766.1650 [GMT 10:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Trend Micro Titanium Maximum Security 2012 *Disabled/Updated* {7193B549-236F-55EE-9AEC-F65279E59A92}
SP: Trend Micro Titanium Maximum Security 2012 *Disabled/Updated* {CAF254AD-0555-5A60-A05C-CD200262D02F}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Liam\AppData\Local\assembly\tmp
c:\windows\system32\DEBUG.log
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Service_NPF
.
.
((((((((((((((((((((((((( Files Created from 2012-04-26 to 2012-05-26 )))))))))))))))))))))))))))))))
.
.
2012-05-26 04:37 . 2012-05-26 04:37 ——– d—–w- c:\users\Space Colony account\AppData\Local\temp
2012-05-26 04:37 . 2012-05-26 04:37 ——– d—–w- c:\users\Guest\AppData\Local\temp
2012-05-26 04:37 . 2012-05-26 04:37 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-05-25 07:12 . 2012-05-25 07:12 ——– d—–w- c:\program files\ESET
2012-05-23 12:47 . 2012-05-23 12:47 ——– d—–w- c:\users\Liam\AppData\Roaming\Malwarebytes
2012-05-22 12:41 . 2012-05-22 12:41 ——– d—–w- c:\programdata\Malwarebytes
2012-05-22 12:41 . 2012-05-22 12:41 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2012-05-22 12:41 . 2012-04-04 05:56 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-05-22 10:23 . 2012-05-22 10:24 ——– d—–w- C:\FRST
2012-05-22 03:10 . 2012-05-26 04:44 ——– d—–w- c:\users\Liam\AppData\Local\temp
2012-05-21 12:21 . 2012-05-21 12:21 ——– d—–w- C:\_OTL
2012-05-20 12:58 . 2012-05-20 12:58 ——– d—–w- c:\users\Liam\AppData\Local\ElevatedDiagnostics
2012-05-20 12:13 . 2012-05-20 12:22 108048 —-a-w- c:\windows\RegBootClean.exe
2012-05-14 11:00 . 2012-05-14 11:00 334008 —-a-r- c:\users\Liam\AppData\Roaming\Microsoft\Installer\{905D6095-7F38-43F3-82A4-8A36E5A00FAD}\BOINCMGRLink_B65C4A4D2B2A46CCA2D918164C6297B8.exe
2012-05-14 11:00 . 2012-05-14 11:00 334008 —-a-r- c:\users\Liam\AppData\Roaming\Microsoft\Installer\{905D6095-7F38-43F3-82A4-8A36E5A00FAD}\ARPPRODUCTICON.exe
2012-05-14 11:00 . 2012-05-14 11:00 ——– d—–w- c:\program files\BOINC
2012-05-12 10:14 . 2012-05-12 10:14 ——– d—–w- c:\users\Guest\AppData\Local\Diagnostics
2012-05-12 08:41 . 2012-03-17 07:27 56176 —-a-w- c:\windows\system32\drivers\partmgr.sys
2012-05-12 08:41 . 2012-03-03 05:31 1077248 —-a-w- c:\windows\system32\DWrite.dll
2012-05-12 08:31 . 2012-03-30 10:23 1291632 —-a-w- c:\windows\system32\drivers\tcpip.sys
2012-05-12 08:31 . 2012-03-31 04:30 1221632 —-a-w- c:\program files\Windows Journal\NBDoc.DLL
2012-05-12 08:31 . 2012-03-31 04:29 936960 —-a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-12 08:31 . 2012-03-31 04:29 989184 —-a-w- c:\program files\Windows Journal\JNTFiltr.dll
2012-05-12 08:31 . 2012-03-31 04:29 969216 —-a-w- c:\program files\Windows Journal\JNWDRV.dll
2012-05-12 08:31 . 2012-03-31 04:39 3968368 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-12 08:31 . 2012-03-31 04:39 3913072 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-05-12 08:31 . 2012-03-31 02:36 2343424 —-a-w- c:\windows\system32\win32k.sys
2012-05-11 12:17 . 2012-05-22 09:43 ——– d—–w- c:\users\Liam\AppData\Roaming\DivX
2012-05-11 12:16 . 2012-05-11 12:16 ——– d—–w- c:\program files\Common Files\PX Storage Engine
2012-05-11 12:14 . 2012-05-11 12:16 ——– d—–w- c:\program files\Common Files\DivX Shared
2012-05-11 11:59 . 2012-05-11 12:17 ——– d—–w- c:\program files\DivX
2012-05-11 11:56 . 2012-05-11 12:17 ——– d—–w- c:\programdata\DivX
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-12 08:57 . 2012-03-31 08:22 419488 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-12 08:57 . 2011-10-08 12:24 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-04 02:05 . 2012-04-04 02:05 869552 —-a-w- c:\windows\boinc.scr
2012-03-01 05:46 . 2012-04-11 16:38 19824 —-a-w- c:\windows\system32\drivers\fs_rec.sys
2012-03-01 05:37 . 2012-04-11 16:38 172544 —-a-w- c:\windows\system32\wintrust.dll
2012-03-01 05:33 . 2012-04-11 16:38 159232 —-a-w- c:\windows\system32\imagehlp.dll
2012-03-01 05:29 . 2012-04-11 16:38 5120 —-a-w- c:\windows\system32\wmi.dll
2012-02-28 01:18 . 2012-04-11 16:40 1799168 —-a-w- c:\windows\system32\jscript9.dll
2012-02-28 01:11 . 2012-04-11 16:40 1427456 —-a-w- c:\windows\system32\inetcpl.cpl
2012-02-28 01:11 . 2012-04-11 16:40 1127424 —-a-w- c:\windows\system32\wininet.dll
2012-02-28 01:03 . 2012-04-11 16:40 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2012-03-13 04:39 . 2011-10-08 12:49 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Liam\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Liam\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Liam\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\Steam\Steam.exe" [2011-10-21 1242448]
"Facebook Update"="c:\users\Liam\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-04-11 137536]
"ManyCam"="c:\program files\ManyCam\Bin\ManyCam.exe" [2011-12-12 1760328]
"Optimizer Pro"="c:\program files\Optimizer Pro\OptProLauncher.exe" [2012-01-02 81912]
"RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2009-07-14 354304]
"ChromeFrameHelper"="c:\users\Liam\AppData\Local\Google\Chrome\Application\19.0.1084.52\chrome_frame_helper.exe" [2012-05-23 96792]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-08 142680]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-08 175960]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-08 177496]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2011-03-02 521640]
"TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2010-12-15 844152]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-12-14 316032]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-03-11 1697064]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-12-08 611736]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 22840]
"TosNC"="c:\program files\Toshiba\BulletinBoard\TosNcCore.exe" [2011-03-02 468904]
"TosReelTimeMonitor"="c:\program files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe" [2010-12-15 31648]
"Trend Micro Titanium"="c:\program files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" [2012-02-27 1304792]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"BSDAppUpdater"="c:\program files\Common Files\BSD\AppUpdater\BSDChecker.exe" [2011-11-15 1660232]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-07 421736]
"DLSService"="c:\program files\DYMO\DYMO Label Software\DLSService.exe" [2010-05-11 55808]
"Talk"="c:\program files\NCH Software\Talk\talk.exe" [2012-02-04 1359364]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-01 843712]
"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2012-02-27 133424]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"boincmgr"="c:\program files\BOINC\boincmgr.exe" [2012-04-04 3654832]
"boinctray"="c:\program files\BOINC\boinctray.exe" [2012-04-04 70832]
.
c:\users\Liam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
DesktopVideoPlayer.lnk - c:\users\Liam\AppData\Local\vghd\bin\vghd.exe [2012-3-21 2330624]
Dropbox.lnk - c:\users\Liam\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-2-15 24246216]
Facebook Messenger.lnk - c:\users\Liam\AppData\Local\Facebook\Messenger\2.1.4520.0\FacebookMessenger.exe [2012-5-17 200704]
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2010-12-21 227712]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2011-3-3 2745760]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer3"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 DymoPnpService;DYMO PnP Service;c:\program files\DYMO\DYMO Label Software\DymoPnpService.exe [x]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-11-22 136176]
R2 WSWNA3100;WSWNA3100;c:\program files\NETGEAR\WNA3100\WifiSvc.exe [2010-08-26 285152]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 ExpressAccountsService;Express Accounts;c:\program files\NCH Software\ExpressAccounts\expressaccounts.exe [2012-02-04 2985988]
R3 ExpressInvoiceService;Express Invoice;c:\program files\NCH Software\ExpressInvoice\expressinvoice.exe [2012-02-04 1987588]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-11-22 136176]
R3 InventoriaService;Inventoria Stock Manager;c:\program files\NCH Software\Inventoria\inventoria.exe [2012-02-04 1511428]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [2011-08-02 18432]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-10-08 190464]
R3 TMachInfo;TMachInfo;c:\program files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2010-11-29 54136]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-10-09 1343400]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-05-06 11520]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 SCMNdisP;General NDIS Protocol Driver;c:\windows\system32\DRIVERS\scmndisp.sys [2007-01-19 21728]
S1 tmevtmgr;tmevtmgr;c:\windows\system32\DRIVERS\tmevtmgr.sys [2011-10-08 68368]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe [x]
S2 AntUpdaterService;Ant Toolbar updater service;c:\program files\Ant.com\IE add-on\AntUpdaterService.exe [2011-06-29 520216]
S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe [2010-01-28 185712]
S2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [2009-03-11 46448]
S2 MSSQL$INFLOWSQL;SQL Server (INFLOWSQL);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-11 29293408]
S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-02-01 2656280]
S3 BtFilter;Bluetooth LowerFilter Class Filter Driver;c:\windows\system32\DRIVERS\btfilter.sys [2010-10-18 33640]
S3 FwLnk;FwLnk Driver;c:\windows\system32\DRIVERS\FwLnk.sys [2009-07-07 7680]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2011-02-09 68720]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys [2008-01-14 21632]
S3 MEI;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECI.sys [2010-10-19 41088]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [2011-11-19 47360]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [2011-02-09 33616]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-12-08 112032]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-25 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3529970971-4163437698-1443127188-1000Core.job
- c:\users\Liam\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-26 09:14]
.
2012-05-25 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3529970971-4163437698-1443127188-1000UA.job
- c:\users\Liam\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-26 09:14]
.
2012-05-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-11-22 10:20]
.
2012-05-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-11-22 10:20]
.
2012-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3529970971-4163437698-1443127188-1000Core.job
- c:\users\Liam\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-20 10:20]
.
2012-05-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3529970971-4163437698-1443127188-1000UA.job
- c:\users\Liam\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-20 10:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com.au/
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: Add to TOSHIBA Bulletin Board - c:\program files\TOSHIBA\BulletinBoard\TosBBCom.dll/1000
IE: E&xport to Microsoft Excel - c:\progra~1\MIF5BA~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MIF5BA~1\Office14\ONBttnIE.dll/105
IE: {{70AF6C9F-0818-4cf7-924A-BBDBB24211D3} - {70AF6C9F-0818-4cf7-924A-BBDBB24211D3} - c:\program files\Ant.com\IE add-on\download.dll
IE: {{97F922BD-8563-4184-87EE-8C4ACA438823} - {5D29E593-73A5-400A-B3BD-6B7A1AF05A31} - c:\program files\TOSHIBA\BulletinBoard\TosBBCom.dll
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\users\Liam\AppData\Roaming\Mozilla\Firefox\Profiles\9uxzcp68.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/?pc=Z190&ocid=zdhp&install_date=20111126
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z190&form=ZGAADF&install_date=20111126&q=
FF - user.js: general.useragent.extra.brc -
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Toolbar-{EA582743-9076-4178-9AA6-7393FDF4D5CE} - c:\program files\Alexa Toolbar\AlexaToolbar.10.0.dll
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{CCAC5586-44D7-4C43-B64A-F042461A97D2}"=hex:51,66,7a,6c,4c,1d,38,12,e8,56,bf,
c8,e5,0a,2d,09,c9,5c,b3,02,43,44,d3,c6
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=hex:51,66,7a,6c,4c,1d,38,12,11,7f,11,
d0,78,5b,08,05,de,bb,01,03,dd,4c,30,54
"{5911488E-9D1E-40EC-8CBB-06B231CC153F}"=hex:51,66,7a,6c,4c,1d,38,12,e0,4b,02,
5d,2c,d3,82,05,f3,ad,45,f2,34,92,51,2b
"{2E924F4F-67F0-4BD8-9560-49F468E843D2}"=hex:51,66,7a,6c,4c,1d,38,12,21,4c,81,
2a,c2,29,b6,0e,ea,76,0a,b4,6d,b6,07,c6
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{1CA1377B-DC1D-4A52-9585-6E06050FAC53}"=hex:51,66,7a,6c,4c,1d,38,12,15,34,b2,
18,2f,92,3c,0f,ea,93,2d,46,00,51,e8,47
"{346FDE31-DFF9-418A-90C8-BA31DC9FF2EF}"=hex:51,66,7a,6c,4c,1d,38,12,5f,dd,7c,
30,cb,91,e4,04,ef,de,f9,71,d9,c1,b6,fb
"{43C6D902-A1C5-45C9-91F6-FD9E90337E18}"=hex:51,66,7a,6c,4c,1d,38,12,6c,da,d5,
47,f7,ef,a7,00,ee,e0,be,de,95,6d,3a,0c
"{6E13D095-45C3-4271-9475-F3B48227DD9F}"=hex:51,66,7a,6c,4c,1d,38,12,fb,d3,00,
6a,f1,0b,1f,07,eb,63,b0,f4,87,79,99,8b
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{9FDDE16B-836F-4806-AB1F-1455CBEFF289}"=hex:51,66,7a,6c,4c,1d,38,12,05,e2,ce,
9b,5d,cd,68,0d,d4,09,57,15,ce,b1,b6,9d
"{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}"=hex:51,66,7a,6c,4c,1d,38,12,07,5b,93,
aa,6e,60,ba,0b,f0,6d,b2,b7,80,44,00,83
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,
b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb
"{BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC}"=hex:51,66,7a,6c,4c,1d,38,12,93,b9,bf,
bf,6c,b4,17,05,f4,25,43,ab,9a,4d,90,b8
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{F3C88694-EFFA-4D78-B409-54B7B2535B14}"=hex:51,66,7a,6c,4c,1d,38,12,fa,85,db,
f7,c8,a1,16,08,cb,1f,17,f7,b7,0d,1f,00
"{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}"=hex:51,66,7a,6c,4c,1d,38,12,70,05,61,
f9,ec,d1,23,0d,da,9c,48,eb,44,0f,8e,cc
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:b4,33,fc,ea,cd,f2,cc,01
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'Explorer.exe'(2980)
c:\users\Liam\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\WLANExt.exe
c:\windows\system32\conhost.exe
c:\program files\Trend Micro\AMSP\coreServiceShell.exe
c:\windows\system32\conhost.exe
c:\program files\Trend Micro\AMSP\coreFrameworkHost.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\system32\TODDSrv.exe
c:\program files\TOSHIBA\Power Saver\TosCoSrv.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\TOSHIBA\ConfigFree\NDSTray.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\TOSHIBA\ConfigFree\CFSwMgr.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\windows\system32\igfxext.exe
c:\program files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Intel\Intel® Management Engine Components\LMS\LMS.exe
c:\program files\BOINC\boinc.exe
c:\windows\system32\conhost.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\programdata\BOINC\projects\www.primegrid.com\primegrid_llr_wrapper_6.13_windows_intelx86.exe
c:\windows\system32\conhost.exe
c:\programdata\BOINC\projects\climateprediction.net\hadam3p_eu_6.09_windows_intelx86.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\programdata\BOINC\slots\3\primegrid_cllr.exe
c:\windows\system32\conhost.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
c:\programdata\BOINC\projects\climateprediction.net\hadam3p_eu_um_6.09_windows_intelx86.exe
c:\windows\system32\conhost.exe
c:\programdata\BOINC\projects\climateprediction.net\hadrm3p_eu_um_6.09_windows_intelx86.exe
c:\windows\system32\conhost.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2012-05-26 14:52:39 - machine was rebooted
ComboFix-quarantined-files.txt 2012-05-26 04:52
.
Pre-Run: 214,862,499,840 bytes free
Post-Run: 214,863,904,768 bytes free
.
- - End Of File - - 45584CDD12EC3F893D8DBC29A0784CE7
