ComboFix 09-05-25.A2 - ONE 06/01/2009 17:07.1 - NTFSx86
Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1256.966.1025.18.2046.1041 [GMT 3:00]
Running from: c:\users\ONE\Documents\Downloads\Programs\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\FunWebProducts
c:\program files\FunWebProducts\Shared\Cache\SmileyCentralBtn.htmlx
c:\program files\Internet Explorer\msimg32.dll
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE
c:\program files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
c:\program files\MyWebSearch\bar\2.bin\MWSOESTB.DLL
c:\program files\MyWebSearch\bar\2.bin\MWSSVC.EXE
c:\program files\ShoppingReport
c:\windows\system32\f3PSSavr.scr
c:\windows\system32\Ultra.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_MyWebSearchService
((((((((((((((((((((((((( Files Created from 2009-05-01 to 2009-06-01 )))))))))))))))))))))))))))))))
.
2009-06-01 14:21 . 2009-06-01 14:28 -------- d-----w c:\users\ONE\AppData\Local\temp
2009-06-01 13:34 . 2009-06-01 13:34 -------- d-----w c:\program files\Trend Micro
2009-05-31 00:28 . 2009-05-31 00:28 -------- d-----w c:\users\ONE\AppData\Local\ACD Systems
2009-05-24 09:59 . 2009-05-24 09:59 468488 ----a-w c:\users\ONE\AppData\Roaming\Real\RealPlayer\Update\RealPlayer11.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-01 14:28 . 2007-09-04 06:30 -------- d-----w c:\programdata\Kaspersky Lab
2009-06-01 14:28 . 2007-09-04 06:30 96130080 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-06-01 14:28 . 2007-09-08 18:13 -------- d-----w c:\users\ONE\AppData\Roaming\DMCache
2009-06-01 14:25 . 2007-09-04 06:30 1294676 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-06-01 14:25 . 2007-09-04 00:03 9900 ----a-w c:\windows\bthservsdp.dat
2009-05-30 20:01 . 2009-03-04 19:06 -------- d-----w c:\program files\Internet Download Manager
2009-05-29 00:01 . 2009-03-26 16:56 -------- d-----w c:\program files\BitSpirit
2009-05-22 21:09 . 2007-09-04 19:57 -------- d-----w c:\programdata\Microsoft Help
2009-05-21 11:07 . 2007-09-04 06:31 94643 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-21 11:07 . 2007-09-04 06:31 105395 ----a-w c:\windows\system32\drivers\klin.dat
2009-05-13 19:00 . 2009-04-02 00:15 -------- d-----w c:\program files\Folder Lock
2009-05-11 11:21 . 2006-12-05 05:25 82094 ----a-w c:\windows\system32\perfc001.dat
2009-05-11 11:21 . 2006-12-05 05:25 463310 ----a-w c:\windows\system32\perfh001.dat
2009-04-24 15:03 . 2007-09-17 13:06 -------- d-----w c:\program files\Google
2009-04-24 00:34 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail
2009-04-19 12:06 . 2009-03-04 19:06 -------- d-----w c:\users\ONE\AppData\Roaming\IDM
2009-04-14 00:39 . 2009-04-27 21:59 4656976 ----a-w c:\programdata\Microsoft\Windows Defender\Definition Updates\{C4EF0A73-438D-4465-8511-FA5794E5E79C}\mpengine.dll
2009-04-06 07:00 . 2007-09-04 18:46 -------- d-----w c:\program files\lg_swupdate
2009-04-03 22:43 . 2009-04-03 22:43 -------- d-----w c:\programdata\Office Genuine Advantage
2009-04-02 01:29 . 2009-04-02 01:29 120240 ----a-w c:\users\ONE\AppData\Roaming\IDM\idmmzcc2\components\idmmzcc.dll
2009-04-02 00:30 . 2009-04-02 00:30 603904 ----a-w c:\windows\system32\TUProgSt.exe
2009-04-02 00:30 . 2009-04-02 00:30 360192 ----a-w c:\windows\system32\TuneUpDefragService.exe
2009-04-02 00:15 . 2009-04-02 00:15 35363 ----a-w c:\windows\system32\windrvNT.sys
2009-03-31 18:24 . 2009-03-31 18:24 460296 ----a-w c:\users\ONE\AppData\Roaming\Real\Update\temp\~Upg1\RealPlayer11.exe
2009-03-17 03:16 . 2009-04-23 13:59 14848 ----a-w c:\windows\system32\apilogen.dll
2009-03-17 03:16 . 2009-04-23 13:59 25600 ----a-w c:\windows\system32\amxread.dll
2009-03-12 23:20 . 2009-03-12 23:20 5607 ----a-w c:\windows\~GLH0001.TMP
2009-03-12 23:20 . 2009-03-12 23:20 129984 ----a-w c:\windows\~GLC0001.TMP
2009-03-06 09:57 . 2009-03-06 09:57 5607 ----a-w c:\windows\~GLH0000.TMP
2009-03-06 09:57 . 2009-03-06 09:57 129984 ----a-w c:\windows\~GLC0000.TMP
2008-07-05 02:08 . 2008-07-05 02:04 2866624 ----a-w c:\program files\FLV PlayerFCSetup.exe
2008-07-05 02:02 . 2008-07-05 02:02 489072 ----a-w c:\program files\FLV PlayerRCSetup.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-24 39408]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-04-02 2594224]
"Google Update"="c:\users\ONE\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-04-23 133104]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-26 835584]
"BatteryMiser 5"="c:\program files\LG Software\BatteryMiser\BatteryMiser5.exe" [2007-02-04 337464]
"KeybdUtility"="c:\program files\LG Software\On Screen Display\HotKey.exe" [2007-02-15 2655800]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"DownloadAccelerator"="c:\program files\DAP\DAP.EXE" [2007-09-17 4601344]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-25 263720]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-09-04 155648]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-03-14 4399104]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"EnableLUA"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{26F5978F-6493-4ee3-B114-C0C3ACCF9D4D}"= "c:\windows\system32\bmpsap.dll" [2006-12-11 114688]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1.0\r3hook.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"LG Intelligent Update"="c:\program files\lg_swupdate\giljabistart.exe" Gilautouc
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe"
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1844192466-1645376907-1487265521-1000]
"EnableNotificationsRef"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{3CB23CD9-D082-4049-8B12-CEFCF471CA19}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{6472A5C6-05AE-4829-AC17-FBCEB6E71BD6}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{3208F2B7-1BFA-45D9-B2AC-D59C73C34954}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{DEC85146-EC4E-4CC7-B5CF-BD478B669562}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{3168F330-C7E7-473D-8729-1C10824A0842}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{4CA551CF-516F-473E-868A-4CC31441663E}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{0DADB04E-25B8-496E-8CA4-F01DF593332F}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{E5F3DA9D-E969-4736-A0C5-EEFD15C7CFD1}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{CDFB0546-337E-4095-8421-520905E38C33}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{1A2995CA-7E95-4774-8337-AB3ADBA4BEAA}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{240B740C-7276-4FA4-9656-0F88E6A126F7}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{059FE5A5-1AD4-410E-B808-BB633B20F8E6}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent
"{FEAA605E-9049-4DB3-B146-B1715E9C435A}"= UDP:c:\program files\DAP\DAP.exe
ownload Accelerator Plus (DAP)
"{7B5F151E-B193-4D10-A970-3D7FB342F465}"= TCP:c:\program files\DAP\DAP.exe
ownload Accelerator Plus (DAP)
"{85BD937F-4BE9-4EA1-A8D7-953486FDC741}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{DEE5F9A3-E95F-4065-A2EE-823DB78F46C5}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{37DDBDF3-25E8-4154-AA85-876F423B863A}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{78CBF4EC-DA21-411B-84D9-5ED0EDDCE1B4}h:\\firefox setup 3.0.3.exe"= UDP:H:\firefox setup 3.0.3.exe:Firefox
"UDP Query User{E473331D-AE16-4FDE-9B8D-029D19195A23}h:\\firefox setup 3.0.3.exe"= TCP:H:\firefox setup 3.0.3.exe:Firefox
"TCP Query User{72F8AACE-D28F-4368-8323-7553369BB10E}c:\\windows\\system32\\taskeng.exe"= UDP:c:\windows\system32\taskeng.exe:مشغل خدمة جدولة المهام
"UDP Query User{8891009E-F975-48D3-A030-34989EDA5BC8}c:\\windows\\system32\\taskeng.exe"= TCP:c:\windows\system32\taskeng.exe:مشغل خدمة جدولة المهام
"TCP Query User{83FFDE4E-7BDC-4D05-80F7-F2520CBE1368}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{941B96EE-B82A-4ED9-A000-ED9D67CBB441}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{DA090CBA-3D46-45EB-9D1D-8AB190FDB993}c:\\program files\\synaptics\\syntp\\syntpenh.exe"= UDP:c:\program files\synaptics\syntp\syntpenh.exe:Synaptics TouchPad Enhancements
"UDP Query User{45755368-7DA0-41F8-AEC6-C7D846016493}c:\\program files\\synaptics\\syntp\\syntpenh.exe"= TCP:c:\program files\synaptics\syntp\syntpenh.exe:Synaptics TouchPad Enhancements
"TCP Query User{92AAD652-B999-43FA-A9EA-B4C9277D7357}c:\\program files\\your freedom\\freedom.exe"= UDP:c:\program files\your freedom\freedom.exe:freedom
"UDP Query User{77CF8F96-A383-4801-A225-CC5916F6C083}c:\\program files\\your freedom\\freedom.exe"= TCP:c:\program files\your freedom\freedom.exe:freedom
"TCP Query User{1AEECAA1-7C68-4538-9856-02DE64C150BC}c:\\program files\\bitspirit\\bitspirit.exe"= UDP:c:\program files\bitspirit\bitspirit.exe:The powerful and easy-to-use BitTorrent Client
"UDP Query User{E9544665-C577-4254-95B7-4605A7A591C0}c:\\program files\\bitspirit\\bitspirit.exe"= TCP:c:\program files\bitspirit\bitspirit.exe:The powerful and easy-to-use BitTorrent Client
"TCP Query User{564142F9-D59F-43F9-BA77-FF6147ACADF5}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{9A0F6F18-A276-4D31-8D5A-4B3C78E9D18C}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{3FF1BAB5-C06C-479F-964D-B98B07179BA0}c:\\program files\\dap\\dap.exe"= UDP:c:\program files\dap\dap.exe
ownload Accelerator Plus (DAP)
"UDP Query User{17A2345B-8675-4EE6-958E-DF4A91FCFCD3}c:\\program files\\dap\\dap.exe"= TCP:c:\program files\dap\dap.exe
ownload Accelerator Plus (DAP)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
"DoNotAllowExceptions"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
"DoNotAllowExceptions"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Windows\\system32\\taskeng.exe"= c:\windows\system32\taskeng.exe:*:Enabled:ipsec
"c:\\Program Files\\DAP\\DAP.exe"= c:\program files\DAP\DAP.exe:*:Enabled:ipsec
"c:\\Program Files\\LG Software\\On Screen Display\\HotKey.exe"= c:\program files\LG Software\On Screen Display\HotKey.exe:*:Enabled:ipsec
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\System32\drivers\klim6.sys [1/25/2007 07:33 م 20760]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\System32\TUProgSt.exe [4/2/2009 03:30 ص 603904]
S0 OemBiosDevice;Royalty OEM Bios Extension;c:\windows\System32\drivers\royal.sys [9/4/2007 11:38 م 240128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
2009-06-01 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 18:36]
2009-05-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1844192466-1645376907-1487265521-1000.job
- c:\users\ONE\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-23 16:13]
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-My Web Search Bar Search Scope Monitor - c:\progra~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe
SafeBoot-procexp90.Sys
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Settings,ProxyServer = stuproxy.kfupm.edu.sa:80
uInternet Settings,ProxyOverride = <local>
IE: &Download with &DAP - c:\program files\DAP\dapextie.htm
IE: &Search -
IE: Download &all with DAP - c:\program files\DAP\dapextie2.htm
IE: Download Using &BitSpirit - c:\program files\BitSpirit\bsurl.htm
IE: تحميل الكل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetVL.htm
IE: سأ±بجط¾«ءéدآشط(&B)
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~1\DAP\dapie.dll
Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~1\DAP\dapie.dll
FF - ProfilePath - c:\users\ONE\AppData\Roaming\Mozilla\Firefox\Profiles\yqjf5ut4.default\
FF - prefs.js: network.proxy.ftp - stuproxy.kfupm.edu.sa
FF - prefs.js: network.proxy.ftp_port - 8080
FF - prefs.js: network.proxy.gopher - stuproxy.kfupm.edu.sa
FF - prefs.js: network.proxy.gopher_port - 8080
FF - prefs.js: network.proxy.http - stuproxy.kfupm.edu.sa
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.socks - stuproxy.kfupm.edu.sa
FF - prefs.js: network.proxy.socks_port - 1080
FF - prefs.js: network.proxy.ssl - stuproxy.kfupm.edu.sa
FF - prefs.js: network.proxy.ssl_port - 8080
FF - prefs.js: network.proxy.type - 1
FF - component: c:\users\ONE\AppData\Roaming\IDM\idmmzcc2\components\idmmzcc.dll
FF - plugin: c:\users\ONE\AppData\Local\Google\Update\1.2.145.5\npGoogleOneClick8.dll
---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-06-01 17:27
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.032"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.ani"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.bay"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.bmp"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.bw"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.cr2"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.crw"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.cs1"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.cur"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.dcr"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.dcx"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.dib"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.djv"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.djvu"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.dng"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.emf"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.eps"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.erf"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.fff"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.fpx"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.gif"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.icl"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.icn"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.ico"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.iff"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.ilbm"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.int"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.inta"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.iw4"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.j2c"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.j2k"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.jfif"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.jif"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.jp2"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.jpc"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.jpe"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.jpeg"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.jpg"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.jpk"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.jpx"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.lbm"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.mos"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.mrw"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.nef"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.orf"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.pbm"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.pcd"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.pct"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.pcx"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.pef"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.pgm"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.pic"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.pict"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.pix"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.png"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.ppm"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.psd"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.psp"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.raf"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.ras"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.raw"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.rgb"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.rgba"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.rle"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.rsb"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.sgi"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.sr2"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.srf"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.tga"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.thm"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.tif"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.tiff"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.ttc"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.ttf"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v9o\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.v9o"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v9p\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.v9p"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v9pf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.v9pf"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.wbm"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.wbmp"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.wmf"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.xbm"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.xif"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 9.0.xpm"
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000_Classes\CLSID\{2584a668-e1bd-47b7-8e1a-97fce73bfc9e}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:00000018
"Therad"=dword:00000011
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,68,06,07,02,a8,95,55,fb,b5,f4,d3,66,b0,39,e4,a2,2b,41,44,e8,7e,9d,\
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000_Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"scansk"=hex(0):10,52,ca,04,9d,37,f6,4a,ce,44,5a,be,e1,a1,2e,23,e2,eb,03,ff,6e,
c7,d8,02,5c,14,ac,ac,2a,5a,d3,53,1b,f5,bb,24,40,2a,62,8d,00,00,00,00,00,00,\
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"scansk"=hex(0):98,43,9b,82,1d,9f,93,02,b6,eb,c4,85,2b,0d,fc,da,01,a8,39,c0,83,
01,6a,a0,d2,d0,5e,f4,8a,29,cc,a2,a5,51,2e,00,03,7c,fb,31,00,00,00,00,00,00,\
[HKEY_USERS\S-1-5-21-1844192466-1645376907-1487265521-1000_Classes\CLSID\{bb154e48-3e34-4dd8-8537-9a01cb4485e4}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:000000f4
"Therad"=dword:0000002e
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,44,1d,ae,0c,5e,03,62,62,5a,42,2f,6e,d9,bd,\
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'Explorer.exe'(3424)
c:\program files\Internet Download Manager\idmmkb.dll
c:\program files\LG Software\BatteryMiser\McIdle.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\Ati2evxx.exe
c:\windows\System32\Ati2evxx.exe
c:\windows\System32\audiodg.exe
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
c:\program files\Common Files\microsoft shared\VS7DEBUG\mdm.exe
c:\windows\System32\WUDFHost.exe
c:\windows\System32\conime.exe
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
c:\program files\Internet Download Manager\IEMonitor.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Completion time: 2009-06-01 17:39 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-01 14:39
Pre-Run: 7,487,246,336 bytes free
Post-Run: 7,772,622,848 bytes free
Current=1 Default=1 Failed=0 LastKnownGood=89 Sets=1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89
546 --- E O F --- 2009-05-21 10:58
