اسفه ع الـتأخير
وهذا التقرير
/
ComboFix 09-07-26.03 - ACER 07/27/2009 20:59.2.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1256.966.1033.18.1014.252 [GMT 3:00]
Running from: c:\users\ACER\Downloads\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((( Files Created from 2009-06-27 to 2009-07-27 )))))))))))))))))))))))))))))))
.
2009-07-27 18:07 . 2009-07-27 18:07 -------- d-----w- c:\users\ACER\AppData\Local\temp
2009-07-27 05:18 . 2009-07-27 05:18 -------- d-----w- c:\program files\Conduit
2009-07-27 05:18 . 2009-07-27 05:18 -------- d-----w- c:\program files\BS_Player
2009-07-25 03:45 . 2009-07-25 03:45 -------- d-----w- c:\users\ACER\AppData\Roaming\VistaCodecs
2009-07-25 03:44 . 2009-07-25 03:45 -------- d-----w- c:\program files\VistaCodecPack
2009-07-25 03:33 . 2009-07-25 03:45 -------- d-----w- c:\programdata\VistaCodecs
2009-07-25 01:45 . 2009-07-25 01:45 -------- d-----w- c:\users\ACER\AppData\Roaming\COWON
2009-07-21 17:01 . 2009-07-21 17:01 12888 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\wmifw.exe
2009-07-21 17:01 . 2009-07-21 17:01 12888 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\wmiav.exe
2009-07-21 17:01 . 2009-07-21 17:01 12888 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\wmias.exe
2009-07-11 03:06 . 2009-07-11 03:06 203776 ----a-w- c:\windows\system32\clrviddc.dll
2009-07-06 09:21 . 2009-07-06 09:21 1003520 ----a-w- c:\windows\system32\VSFilter.dll
2009-07-03 04:52 . 2009-07-03 04:52 -------- d-----w- c:\windows\BDOSCAN8
2009-07-03 04:32 . 2009-07-03 04:32 -------- d-----w- c:\program files\Trend Micro
2009-07-03 04:27 . 2009-07-03 04:27 -------- d-----w- c:\users\ACER\AppData\Local\Runscanner.net
2009-07-03 04:15 . 2007-05-17 08:26 185776 ----a-w- c:\windows\system32\SRSTSHD.dll
2009-07-03 04:15 . 2007-04-16 14:09 167936 ----a-w- c:\windows\system32\SRSHP360.dll
2009-07-03 04:15 . 2007-04-13 05:08 135168 ----a-w- c:\windows\system32\SRSWOW.dll
2009-07-03 04:15 . 2006-12-13 07:30 339968 ----a-w- c:\windows\system32\SRSTSXT.dll
2009-07-03 04:15 . 2007-05-28 17:39 1826816 ----a-w- c:\windows\SkyTel.exe
2009-07-03 04:15 . 2007-05-30 17:07 1780576 ----a-w- c:\windows\system32\drivers\RTKVHDA.sys
2009-07-03 04:15 . 2007-05-21 14:02 16384 ----a-w- c:\windows\system32\RtkCoInst.dll
2009-07-03 04:15 . 2007-05-18 15:47 563712 ----a-w- c:\windows\system32\RtkPgExt.dll
2009-07-03 04:15 . 2007-03-23 12:34 266240 ----a-w- c:\windows\system32\RtkApoApi.dll
2009-07-03 04:15 . 2007-01-16 07:39 1191936 ----a-w- c:\windows\RtlUpd.exe
2009-07-03 04:15 . 2009-07-03 04:15 -------- d-----w- c:\program files\Realtek
2009-07-03 04:15 . 2007-05-28 13:29 4472832 ----a-w- c:\windows\RtHDVCpl.exe
2009-07-03 04:14 . 2007-01-12 13:54 520192 ----a-w- c:\windows\RtlExUpd.dll
2009-07-02 00:18 . 2009-07-27 06:21 -------- d-----w- c:\program files\MessengerDiscovery
2009-07-01 12:22 . 2009-07-01 12:22 114688 ----a-w- c:\users\ACER\AppData\Roaming\Mozilla\Firefox\Profiles\ymmp114x.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\components\npmozax.dll
2009-07-01 01:47 . 2007-05-02 11:02 1911808 ----a-w- c:\windows\system32\RtkAPO.dll
2009-06-30 23:57 . 2008-01-08 10:10 98304 ----a-w- c:\windows\RTKAUDIOSERVICE.EXE
2009-06-30 23:53 . 2007-07-13 11:11 8 ----a-w- c:\windows\system32\drivers\RtkHDAud.dat
2009-06-27 22:06 . 2009-06-27 22:13 -------- d-----w- c:\program files\Error Repair Professional
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2017-01-02 20:43 . 2009-02-13 21:47 77176 ----a-w- c:\windows\Fonts\SC_OUHOD.ttf
2016-12-30 15:32 . 2009-02-13 21:47 90072 ----a-w- c:\windows\Fonts\SC_REHAN.ttf
2016-12-30 15:06 . 2009-02-13 21:47 70064 ----a-w- c:\windows\Fonts\SC_TARABLUS.ttf
2016-12-30 15:05 . 2009-02-13 21:47 102264 ----a-w- c:\windows\Fonts\SC_SHMOOKH01.ttf
2016-12-30 15:05 . 2009-02-13 21:47 66792 ----a-w- c:\windows\Fonts\SC_SHARJAH.ttf
2016-12-30 15:04 . 2009-02-13 21:47 66852 ----a-w- c:\windows\Fonts\SC_LUJAYN.ttf
2016-12-30 15:03 . 2009-02-13 21:47 64908 ----a-w- c:\windows\Fonts\SC_KHALID.ttf
2016-12-30 15:03 . 2009-02-13 21:47 63168 ----a-w- c:\windows\Fonts\SC_HANI.ttf
2016-12-30 15:02 . 2009-02-13 21:47 81648 ----a-w- c:\windows\Fonts\SC_GULF.ttf
2016-12-30 15:02 . 2009-02-13 21:47 75820 ----a-w- c:\windows\Fonts\SC_DUBAI.ttf
2016-12-30 15:01 . 2009-02-13 21:47 70368 ----a-w- c:\windows\Fonts\SC_AMEEN.ttf
2016-12-30 15:00 . 2009-02-13 21:47 86304 ----a-w- c:\windows\Fonts\SC_ALYERMOOK.ttf
2009-07-27 17:55 . 2009-02-16 12:15 -------- d-----w- c:\programdata\Kaspersky Lab
2009-07-27 17:25 . 2009-02-18 01:52 -------- d-----w- c:\users\ACER\AppData\Roaming\uTorrent
2009-07-27 07:37 . 2008-09-25 21:33 -------- d-----w- c:\users\ACER\AppData\Roaming\BSplayer
2009-07-27 07:19 . 2009-02-16 12:15 671776 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-07-27 07:19 . 2009-02-16 12:15 4587552 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-07-27 07:19 . 2009-02-16 12:15 4424 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-07-27 07:19 . 2009-02-16 12:15 37968 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-07-27 07:19 . 2008-03-27 13:53 12 ----a-w- c:\windows\bthservsdp.dat
2009-07-27 05:13 . 2008-09-25 21:34 -------- d-----w- c:\program files\BS.Player ControlBar
2009-07-26 01:12 . 2009-04-18 11:16 680 ----a-w- c:\users\ACER\AppData\Local\d3d9caps.dat
2009-07-25 17:29 . 2009-07-25 17:29 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdRapi_01_00_00.Wdf
2009-07-25 03:46 . 2008-10-27 12:15 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-07-23 21:23 . 2009-04-16 23:04 -------- d-----w- c:\program files\Circle Developement
2009-07-23 21:22 . 2008-09-25 08:32 -------- d-----w- c:\program files\Messenger Plus! Live
2009-07-23 21:22 . 2008-09-25 01:50 -------- d-----w- c:\program files\MSN Messenger
2009-07-21 17:01 . 2009-02-16 12:50 208616 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\avp.exe
2009-07-04 20:52 . 2008-02-12 19:34 -------- d-----w- c:\program files\Common Files\Adobe
2009-07-03 04:15 . 2008-02-12 19:29 319456 ----a-w- c:\windows\DIFxAPI.dll
2009-07-03 04:15 . 2008-02-12 19:28 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-03 00:59 . 2009-06-25 08:02 -------- d-----w- c:\program files\Common Files\Common Share
2009-06-30 08:46 . 2008-02-12 19:29 315392 ----a-w- c:\windows\HideWin.exe
2009-06-29 05:01 . 2008-09-25 21:33 -------- d-----w- c:\users\ACER\AppData\Roaming\BSplayer Pro
2009-06-29 04:58 . 2008-09-25 01:40 -------- d-----w- c:\program files\Webteh
2009-06-27 02:46 . 2009-06-25 15:46 -------- d-----w- c:\program files\Unlocker
2009-06-25 15:47 . 2009-06-25 15:46 -------- d-----w- c:\users\ACER\AppData\Roaming\Desktopicon
2009-06-22 00:47 . 2009-06-17 23:29 -------- d-----w- c:\users\ACER\AppData\Roaming\MessengerDiscovery 2
2009-06-14 21:17 . 2009-06-14 21:15 -------- d-----w- c:\users\ACER\AppData\Roaming\PerfectClock2007
2009-06-09 14:59 . 2009-06-09 14:59 -------- d-----w- c:\users\ACER\AppData\Roaming\Media Player Classic
2009-06-08 21:15 . 2009-06-08 21:15 -------- d-----w- c:\programdata\PerfectClock2007
2009-06-05 11:26 . 2009-06-05 11:26 -------- d-----w- c:\users\ACER\AppData\Roaming\ImTOO Software Studio
2009-06-04 11:01 . 2009-06-04 10:38 -------- d-----w- c:\program files\Magic Video Converter
2009-06-04 10:59 . 2009-06-04 10:39 -------- d-----w- c:\users\ACER\AppData\Roaming\Vso
2009-06-04 10:59 . 2009-06-04 10:39 81920 ----a-w- c:\users\ACER\AppData\Roaming\ezpinst.exe
2009-06-04 10:59 . 2009-06-04 10:39 81920 ----a-w- c:\users\ACER\AppData\Roaming\ezpinst.exe
2009-06-04 10:59 . 2009-06-04 10:39 47360 ----a-w- c:\users\ACER\AppData\Roaming\pcouffin.sys
2009-06-04 10:59 . 2009-06-04 10:39 47360 ----a-w- c:\users\ACER\AppData\Roaming\pcouffin.sys
2009-06-04 10:39 . 2009-06-04 10:39 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-06-01 09:47 . 2008-09-25 01:48 -------- d-----w- c:\program files\Common Files\Real
2009-05-30 19:50 . 2009-05-30 19:50 -------- d-----w- c:\users\ACER\AppData\Roaming\Codemonster
2009-05-30 19:50 . 2009-05-30 19:50 -------- d-----w- c:\program files\Codemonster
2009-05-21 16:51 . 2008-09-24 14:41 247776 ----a-w- c:\users\ACER\AppData\Local\GDIPFONTCACHEV1.DAT
2009-05-21 16:49 . 2009-02-16 12:16 105395 ----a-w- c:\windows\system32\drivers\klin.dat
2009-05-21 16:49 . 2009-02-16 12:16 94643 ----a-w- c:\windows\system32\drivers\klick.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-01-03 10:00 39472 ----a-w- c:\acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-07-21 208616]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-07-12 198160]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-05-28 4472832]
"Skytel"="Skytel.exe" - c:\windows\SkyTel.exe [2007-05-28 1826816]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-12-21 113664]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-3-29 719664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd.dll c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~1\adialhk.dll c:\progra~1\KASPER~1\KASPER~1\kloehk.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux4"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Empowering Technology Launcher.lnk]
backup=c:\windows\pss\Empowering Technology Launcher.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^Users^ACER^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1446437449-4158093185-8341613-1000]
"EnableNotificationsRef"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{41360454-36E4-4FB0-90A8-016DD41E2C39}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{A0A7B12E-881C-4068-980E-9EEB8DFE3E41}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{5BC6D56B-315F-47ED-BC38-63777C35DD5D}"= c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
"{3C641C9D-535B-400C-9EC1-B55243A6A57A}"= c:\program files\Acer Arcade Deluxe\VideoMagician\VideoMagician.exe:VideoMagician
"{8D7B173A-67B1-4DD5-96C8-EC3BE775A74C}"= c:\program files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:HomeMedia
"{E9C27A41-36DE-4EFF-B0A9-48515FAA57F1}"= c:\program files\Acer Arcade Deluxe\DV Wizard\DV Wizard.exe
V Wizard
"{D39609FC-CD46-42E1-BF6F-D1663AEBEE70}"= c:\program files\Acer Arcade Deluxe\DVDivine\DVDivine.exe
VDivine
"{221DD4A0-1FD8-4D2C-868F-25F8E2CB2679}"= c:\program files\Acer Arcade Deluxe\Play Movie\PlayMovie.exe
lay Movie
"{CA48281E-FE6F-473E-99E2-1FB746D74C07}"= c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe
lay Movie Resident Program
"{36956D80-C367-48DD-BB60-029BA472A6D6}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{A2C19282-E637-49BF-8075-911C2B5A514B}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{0E862135-7C64-4DF4-A87B-10A2FDF0E851}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{E84B6D22-4439-4BD4-8044-9EC76FB15E26}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{C8FC390F-AE9B-412E-B3DC-45E20F826B3D}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{474E2FB0-6517-4446-8285-8B8F5F6803C2}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{CF1672DE-E2D6-4837-949F-219F6438A5AC}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{90055506-106D-43E0-8184-04A5BE535953}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{21AAEE6B-F120-4A6B-A9E0-8B040B3A59B4}"= UDP:990:LocalSubnet:LocalSubnet|IF={23F58BF9-3BAD-42C9-A874-540DB242530B}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr
%systemroot%\WindowsMobile\wmdSync.exe,-4001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\System32\drivers\klbg.sys [1/29/2008 5:29 PM 33808]
R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [1/6/2009 11:37 PM 111184]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\System32\drivers\klim6.sys [7/9/2008 5:28 PM 20496]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl [3/27/2008 5:05 PM 41456]
R2 ALaunchService;ALaunch Service;c:\acer\ALaunch\ALaunchSvc.exe [2/12/2008 10:27 PM 51200]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [1/6/2009 11:37 PM 20560]
R2 PoliceService;PoliceService;c:\windows\System32\srksrv.exe [2/21/2009 5:35 PM 453120]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [7/23/2007 2:00 AM 180736]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\System32\drivers\klfltdev.sys [3/13/2008 6:02 PM 26640]
R3 tap0801;TAP-Win32 Adapter V8;c:\windows\System32\drivers\tap0801.sys [10/2/2006 1:37 AM 26624]
R3 winbondcir;Winbond IR Transceiver;c:\windows\System32\drivers\winbondcir.sys [3/28/2007 6:51 PM 43008]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Contents of the 'Scheduled Tasks' folder
2009-07-26 c:\windows\Tasks\User_Feed_Synchronization-{B044ECD0-DDC9-4F9F-93C9-09C1B68E15BE}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
- - - - ORPHANS REMOVED - - - -
BHO-{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - (no file)
Toolbar-{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - (no file)
WebBrowser-{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - (no file)
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://en.us.acer.yahoo.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
IE: Download ALL with IDA
IE: Download with IDA
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: إضافة إلى حاجب الدعايات - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
DPF: Microsoft XML Parser for Java -
DPF: {B7FDB0C3-4724-46D2-B8DB-6FA1DC63F7CA} - hxxp://voice2.maxvoice.net:1999/ReadUid.CAB
.
**************************************************************************
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0011\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-07-27 21:10
ComboFix-quarantined-files.txt 2009-07-27 18:10
Pre-Run: 53,633,748,992 bytes free
Post-Run: 53,564,669,952 bytes free
292
