StarGazer368

November 15, 2012

Didn't have a chance to reboot after seeing "Illegal operation attempted on a registery key that has been marked for deletion" while attempting to open Outlook, Firefox and the like. I ended up restoring from the restore point made by ComboFix. I will run it again if needed but I realize now I need to do so after work hours so I have more time.

The log was saved:

ComboFix 12-11-14.01 - jfunk 11/15/2012 8:39.1.4 - x64

Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.8089.6050 [GMT -5:00]

Running from: c:\users\jfunk\Downloads\ComboFix.exe

AV: Lavasoft Ad-Aware *Enabled/Updated* {445B48C3-0FA4-6B16-8F07-6506F305D800}

AV: Symantec Endpoint Protection *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

FW: Lavasoft Ad-Aware *Disabled* {7C60C9E6-45CB-6A4E-A458-CC330DD69F7B}

FW: Symantec Endpoint Protection *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

SP: Lavasoft Ad-Aware *Enabled/Updated* {FF3AA927-299E-6498-B5B7-5E74888292BD}

SP: Symantec Endpoint Protection *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk

c:\users\jfunk\AppData\Local\assembly\tmp

c:\users\jfunk\AppData\Roaming\adaware-installer-reboot-required.tmp

c:\windows\SysWow64\instsrv.exe

.

((((((((((((((((((((((((( Files Created from 2012-10-15 to 2012-11-15 )))))))))))))))))))))))))))))))

.

2012-11-15 13:43 . 2012-11-15 13:43 -------- d-----w- c:\users\Win7Client\AppData\Local\temp

2012-11-15 13:43 . 2012-11-15 13:43 -------- d-----w- c:\users\swalter\AppData\Local\temp

2012-11-14 21:21 . 2012-11-14 21:21 -------- d-----w- c:\users\jfunk\AppData\Roaming\Aim

2012-11-14 21:20 . 2012-11-14 21:20 -------- d-----w- c:\programdata\Viewpoint

2012-11-14 21:20 . 2012-11-14 21:20 -------- d-----w- c:\program files (x86)\Viewpoint

2012-11-14 21:20 . 2012-11-14 21:20 -------- d-----w- c:\program files (x86)\AOD

2012-11-14 20:50 . 2012-11-14 20:50 -------- d-----w- c:\program files (x86)\Common Files\Software Update Utility

2012-11-14 20:43 . 2012-11-14 21:24 -------- d-----w- c:\program files (x86)\Common Files\AOL

2012-11-14 15:50 . 2012-11-14 15:50 -------- d-----w- c:\users\jfunk\AppData\Roaming\Malwarebytes

2012-11-14 15:00 . 2012-11-14 15:00 -------- d-----w- c:\programdata\Malwarebytes

2012-11-14 15:00 . 2012-11-14 15:01 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-11-14 15:00 . 2012-09-30 00:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-11-14 14:05 . 2012-11-14 14:05 -------- d-----w- c:\users\jfunk\AppData\Roaming\LavasoftStatistics

2012-11-14 13:53 . 2012-11-14 13:53 -------- d-----w- c:\users\jfunk\AppData\Local\Downloaded Installations

2012-11-13 13:45 . 2012-10-12 07:19 9291768 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{86AB7AB5-2730-4AD6-B47C-97235C5E0F23}\mpengine.dll

2012-10-22 17:42 . 2012-09-28 04:18 65309168 ----a-w- c:\windows\system32\MRT.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-11-08 13:03 . 2012-03-30 12:36 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-11-08 13:03 . 2012-02-29 14:58 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-10-09 14:24 . 2012-10-09 14:24 10220472 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe

2012-09-14 19:19 . 2012-10-10 12:28 2048 ----a-w- c:\windows\system32\tzres.dll

2012-09-14 18:28 . 2012-10-10 12:28 2048 ----a-w- c:\windows\SysWow64\tzres.dll

2012-08-30 18:03 . 2012-10-10 12:28 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-08-30 17:12 . 2012-10-10 12:28 3968880 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

2012-08-30 17:12 . 2012-10-10 12:28 3914096 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

2012-08-24 18:05 . 2012-10-10 12:28 220160 ----a-w- c:\windows\system32\wintrust.dll

2012-08-24 16:57 . 2012-10-10 12:28 172544 ----a-w- c:\windows\SysWow64\wintrust.dll

2012-08-24 11:15 . 2012-09-24 22:04 17810944 ----a-w- c:\windows\system32\mshtml.dll

2012-08-24 10:39 . 2012-09-24 22:04 10925568 ----a-w- c:\windows\system32\ieframe.dll

2012-08-24 10:31 . 2012-09-24 22:05 2312704 ----a-w- c:\windows\system32\jscript9.dll

2012-08-24 10:22 . 2012-09-24 22:05 1346048 ----a-w- c:\windows\system32\urlmon.dll

2012-08-24 10:21 . 2012-09-24 22:05 1392128 ----a-w- c:\windows\system32\wininet.dll

2012-08-24 10:20 . 2012-09-24 22:05 1494528 ----a-w- c:\windows\system32\inetcpl.cpl

2012-08-24 10:18 . 2012-09-24 22:05 237056 ----a-w- c:\windows\system32\url.dll

2012-08-24 10:17 . 2012-09-24 22:05 85504 ----a-w- c:\windows\system32\jsproxy.dll

2012-08-24 10:14 . 2012-09-24 22:05 173056 ----a-w- c:\windows\system32\ieUnatt.exe

2012-08-24 10:14 . 2012-09-24 22:05 816640 ----a-w- c:\windows\system32\jscript.dll

2012-08-24 10:13 . 2012-09-24 22:05 599040 ----a-w- c:\windows\system32\vbscript.dll

2012-08-24 10:12 . 2012-09-24 22:05 2144768 ----a-w- c:\windows\system32\iertutil.dll

2012-08-24 10:11 . 2012-09-24 22:05 729088 ----a-w- c:\windows\system32\msfeeds.dll

2012-08-24 10:10 . 2012-09-24 22:05 96768 ----a-w- c:\windows\system32\mshtmled.dll

2012-08-24 10:09 . 2012-09-24 22:05 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2012-08-24 10:04 . 2012-09-24 22:05 248320 ----a-w- c:\windows\system32\ieui.dll

2012-08-24 06:59 . 2012-09-24 22:05 1800704 ----a-w- c:\windows\SysWow64\jscript9.dll

2012-08-24 06:51 . 2012-09-24 22:05 1129472 ----a-w- c:\windows\SysWow64\wininet.dll

2012-08-24 06:51 . 2012-09-24 22:05 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl

2012-08-24 06:47 . 2012-09-24 22:05 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe

2012-08-24 06:47 . 2012-09-24 22:05 420864 ----a-w- c:\windows\SysWow64\vbscript.dll

2012-08-24 06:43 . 2012-09-24 22:05 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

2012-08-22 18:12 . 2012-09-12 12:15 1913200 ----a-w- c:\windows\system32\drivers\tcpip.sys

2012-08-22 18:12 . 2012-09-12 12:15 376688 ----a-w- c:\windows\system32\drivers\netio.sys

2012-08-22 18:12 . 2012-09-12 12:15 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58 94208 ----a-w- c:\users\jfunk\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58 94208 ----a-w- c:\users\jfunk\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58 94208 ----a-w- c:\users\jfunk\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"PhotoSync"="c:\program files (x86)\PhotoSync\PhotoSync.exe" [2012-03-14 1732208]

"Spotify Web Helper"="c:\users\jfunk\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-09-04 1193176]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2010-03-12 462993]

"RemoteControl9"="c:\program files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe" [2010-10-01 87336]

"PDVD9LanguageShortcut"="c:\program files (x86)\CyberLink\PowerDVD9\Language\Language.exe" [2010-09-18 50472]

"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]

"Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-07-31 38872]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-11 919008]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]

.

c:\users\Administrator.ESCHOOLMALL\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\