أوكيشن انــآ الحين طبقت كل شيء ..
وطلعتــلـي المفـــكرره ونسسخت الكـلآـأإم اللي فيهـآ ...
ComboFix 09-09-22.02 - A 09/23/2009 7:28.2.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1256.966.1025.18.1790.1101 [GMT 3:00]
Running from: c:\users\Public\Documents\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: AVG Anti-Virus Free *enabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-2365545147-1999384947-2466353664-500
c:\program files\FunWebProducts
c:\program files\FunWebProducts\Installr\2.bin\F3EZSETP.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
c:\program files\MyWebSearch\bar\1.bin\F3REGHK.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
c:\program files\MyWebSearch\bar\2.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\2.bin\F3CJPEG.DLL
c:\program files\MyWebSearch\bar\2.bin\F3DTactl.dll
c:\program files\MyWebSearch\bar\2.bin\F3HISTSW.DLL
c:\program files\MyWebSearch\bar\2.bin\F3HKSTUB.DLL
c:\program files\MyWebSearch\bar\2.bin\F3HTmlmu.dll
c:\program files\MyWebSearch\bar\2.bin\F3HTtpct.dll
c:\program files\MyWebSearch\bar\2.bin\F3POPSWT.DLL
c:\program files\MyWebSearch\bar\2.bin\F3PSSAVR.SCR
c:\program files\MyWebSearch\bar\2.bin\F3REGHK.DLL
c:\program files\MyWebSearch\bar\2.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\2.bin\F3RESTUB.DLL
c:\program files\MyWebSearch\bar\2.bin\F3SCHMON.EXE
c:\program files\MyWebSearch\bar\2.bin\F3SCrctr.dll
c:\program files\MyWebSearch\bar\2.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\2.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\2.bin\F3WPHOOK.DLL
c:\program files\MyWebSearch\bar\2.bin\FWPBUDDY.PNG
c:\program files\MyWebSearch\bar\2.bin\M3AUXSTB.DLL
c:\program files\MyWebSearch\bar\2.bin\M3DLGHK.DLL
c:\program files\MyWebSearch\bar\2.bin\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\2.bin\M3FFXTBR.MANIFEST
c:\program files\MyWebSearch\bar\2.bin\M3HIGHIN.EXE
c:\program files\MyWebSearch\bar\2.bin\M3HTml.dll
c:\program files\MyWebSearch\bar\2.bin\M3IDLE.DLL
c:\program files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE
c:\program files\MyWebSearch\bar\2.bin\M3MEDINT.EXE
c:\program files\MyWebSearch\bar\2.bin\M3MSG.DLL
c:\program files\MyWebSearch\bar\2.bin\M3NTSTBR.JAR
c:\program files\MyWebSearch\bar\2.bin\M3NTSTBR.MANIFEST
c:\program files\MyWebSearch\bar\2.bin\M3OUTLCN.DLL
c:\program files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL
c:\program files\MyWebSearch\bar\2.bin\M3SKIN.DLL
c:\program files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE
c:\program files\MyWebSearch\bar\2.bin\M3SLSRCH.EXE
c:\program files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE
c:\program files\MyWebSearch\bar\2.bin\MWSBAR.DLL
c:\program files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
c:\program files\MyWebSearch\bar\2.bin\MWSOEPLG.DLL
c:\program files\MyWebSearch\bar\2.bin\MWSOESTB.DLL
c:\program files\MyWebSearch\bar\2.bin\MWSSrcas.dll
c:\program files\MyWebSearch\bar\2.bin\MWSSVC.EXE
c:\program files\MyWebSearch\bar\2.bin\NPMYWEBS.DLL
c:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
c:\program files\MyWebSearch\bar\Game\CHESS.F3S
c:\program files\MyWebSearch\bar\Game\REVERSI.F3S
c:\program files\MyWebSearch\bar\icons\CM.ICO
c:\program files\MyWebSearch\bar\icons\MFC.ICO
c:\program files\MyWebSearch\bar\icons\PSS.ICO
c:\program files\MyWebSearch\bar\icons\SMILEY.ICO
c:\program files\MyWebSearch\bar\icons\WB.ICO
c:\program files\MyWebSearch\bar\icons\ZWINKY.ICO
c:\program files\MyWebSearch\bar\Message\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\DOG.F3S
c:\program files\MyWebSearch\bar\Notifier\FISH.F3S
c:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S
c:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
c:\program files\MyWebSearch\bar\Notifier\MAID.F3S
c:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S
c:\program files\MyWebSearch\bar\Notifier\OPERA.F3S
c:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S
c:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S
c:\program files\MyWebSearch\bar\Notifier\SURFER.F3S
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\users\A\AppData\Roaming\Microsoft\Clip Organizer\mstore10.mgc
c:\users\A\AppData\Roaming\Microsoft\Clip Organizer\Offic10.MGC
c:\windows\Installer\3d7a6d.msi
c:\windows\system32\bcmwl6.inf
c:\windows\System32\Desktop_.ini
c:\windows\system32\f3PSSavr.scr
c:\windows\system32\kakle.dll
c:\windows\system32\oem10.inf
.
((((((((((((((((((((((((( Files Created from 2009-08-23 to 2009-09-23 )))))))))))))))))))))))))))))))
.
2040-07-07 06:59 . 2040-07-07 06:59 4096 ----a-w- c:\users\A\AppData\Local\TimerStop.sys
2009-09-23 04:40 . 2009-09-23 04:42 -------- d-----w- c:\users\A\AppData\Local\temp
2009-09-23 04:40 . 2009-09-23 04:40 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-09-22 06:12 . 2009-09-22 06:12 -------- d-----w- c:\users\A\AppData\Roaming\Malwarebytes
2009-09-22 06:12 . 2009-09-10 11:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-22 06:12 . 2009-09-22 06:12 -------- d-----w- c:\programdata\Malwarebytes
2009-09-22 06:12 . 2009-09-22 06:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-22 06:12 . 2009-09-10 11:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-22 06:01 . 2009-09-22 06:01 -------- d-----w- c:\program files\Trend Micro
2009-09-20 12:01 . 2009-09-20 12:01 -------- d-----w- c:\windows\system32\?©???©?©?©?©?©?©
2009-09-20 09:13 . 2009-09-20 09:13 -------- d-----w- c:\program files\LameACM
2009-09-20 09:12 . 2009-09-20 09:15 -------- d-----w- c:\program files\SWiSH Max3
2009-09-20 08:37 . 2004-04-15 22:07 73728 ----a-w- c:\windows\system32\Crypserv.exe
2009-09-20 08:37 . 2003-07-29 06:18 28518 ----a-w- c:\windows\system32\Ckldrv.sys
2009-09-20 08:37 . 1999-06-18 21:49 165888 ----a-w- c:\windows\Ckconfig.exe
2009-09-20 08:37 . 1996-05-03 17:21 27648 ----a-r- c:\windows\Setup_ck.exe
2009-09-20 08:37 . 1996-05-03 15:36 18432 ----a-w- c:\windows\Setup_ck.dll
2009-09-20 08:37 . 1995-07-04 18:33 11776 ----a-w- c:\windows\Ckrfresh.exe
2009-09-18 18:59 . 2009-09-18 18:59 -------- d-----w- c:\users\A\AppData\Local\Iminent
2009-09-16 00:15 . 2009-09-16 00:15 -------- dc----w- c:\windows\system32\DRVSTORE
2009-09-16 00:15 . 2009-08-05 19:48 54632 ----a-w- c:\windows\system32\drivers\fssfltr.sys
2009-09-16 00:14 . 2009-09-16 00:14 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-09-16 00:12 . 2009-09-16 00:12 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-09-15 01:06 . 2009-09-15 01:06 -------- d-----w- c:\program files\Conduit
2009-09-15 01:06 . 2009-09-15 01:06 -------- d-----w- c:\program files\IMBooster4web-en
2009-09-15 01:05 . 2009-09-15 01:05 -------- d--h--w- c:\programdata\{043AF2C6-8F13-4D97-B13C-0ECF538281D9}
2009-09-15 01:04 . 2009-09-15 01:05 -------- d-----w- c:\programdata\Iminent
2009-09-15 01:03 . 2009-09-15 01:05 -------- d-----w- c:\program files\Iminent
2009-09-15 01:03 . 2009-09-15 01:04 -------- d--h--w- c:\programdata\{567066F5-4167-42EB-91E3-FC7889D390C7}
2009-09-10 00:05 . 2009-07-11 19:26 123904 ----a-w- c:\windows\system32\L2SecHC.dll
2009-09-10 00:05 . 2009-07-11 19:32 67584 ----a-w- c:\windows\system32\wlanhlp.dll
2009-09-10 00:05 . 2009-07-11 19:32 47104 ----a-w- c:\windows\system32\wlanapi.dll
2009-09-10 00:05 . 2009-07-11 19:32 502272 ----a-w- c:\windows\system32\wlansvc.dll
2009-09-10 00:05 . 2009-07-11 19:32 297984 ----a-w- c:\windows\system32\wlansec.dll
2009-09-10 00:05 . 2009-07-11 19:32 290816 ----a-w- c:\windows\system32\wlanmsm.dll
2009-09-10 00:05 . 2009-06-10 12:07 2855424 ----a-w- c:\windows\system32\mf.dll
2009-09-10 00:05 . 2009-06-10 08:50 2048 ----a-w- c:\windows\system32\mferror.dll
2009-09-10 00:05 . 2009-06-10 12:07 98816 ----a-w- c:\windows\system32\mfps.dll
2009-09-10 00:05 . 2009-06-10 10:15 24576 ----a-w- c:\windows\system32\mfpmp.exe
2009-09-10 00:05 . 2009-06-10 10:14 52736 ----a-w- c:\windows\system32\rrinstaller.exe
2009-09-07 01:26 . 2009-09-07 01:27 -------- d-----w- c:\program files\PhotoZoom Pro 2
2009-09-03 15:16 . 2009-09-19 01:07 12 ----a-w- c:\windows\bthservsdp.dat
2009-09-02 07:55 . 2009-08-29 03:41 1686528 ----a-w- c:\windows\system32\gameux.dll
2009-09-02 07:55 . 2009-08-29 03:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-09-02 07:55 . 2009-08-28 23:31 4247552 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-09-02 01:01 . 2009-09-02 01:01 -------- d-----w- c:\program files\CCleaner
2009-08-27 00:00 . 2009-06-22 08:44 2048 ----a-w- c:\windows\system32\tzres.dll
2009-08-26 01:19 . 2009-08-26 08:17 -------- d-----w- c:\program files\SweetIM
2009-08-26 01:19 . 2009-08-26 01:19 -------- d-----w- c:\programdata\SweetIM
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2040-07-07 06:59 . 2009-07-07 06:56 6136 ----a-w- c:\users\A\AppData\Local\TimerStop64.sys
2009-09-23 04:41 . 2009-07-21 00:49 -------- d-----w- c:\users\A\AppData\Roaming\DMCache
2009-09-23 03:46 . 2009-07-08 20:28 27459 ----a-w- c:\users\A\AppData\Roaming\nvModes.dat
2009-09-22 17:59 . 2009-07-07 11:30 -------- d-----w- c:\users\A\AppData\Roaming\vlc
2009-09-22 12:54 . 2009-07-11 11:30 -------- d-----w- c:\users\A\AppData\Roaming\dvdcss
2009-09-21 07:27 . 2006-12-05 05:21 81136 ----a-w- c:\windows\system32\perfc001.dat
2009-09-21 07:27 . 2006-12-05 05:21 460662 ----a-w- c:\windows\system32\perfh001.dat
2009-09-16 00:15 . 2009-07-07 11:10 -------- d-----w- c:\program files\Windows Live
2009-09-16 00:10 . 2009-08-18 12:56 -------- d-----w- c:\program files\Microsoft
2009-09-11 02:45 . 2009-08-16 16:34 -------- d-----w- c:\users\A\AppData\Roaming\MessengerDiscovery 2
2009-09-10 05:50 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-09-10 00:01 . 2009-07-07 10:59 -------- d-----w- c:\programdata\Microsoft Help
2009-09-09 10:33 . 2009-07-07 11:13 -------- d-----w- c:\programdata\Hold Trust Amok Mode
2009-09-09 10:33 . 2009-07-07 11:12 -------- d-----w- c:\programdata\SlowScr
2009-09-02 02:27 . 2009-07-07 06:53 139496 ----a-w- c:\users\A\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-31 20:59 . 2009-08-31 20:59 137 ----a-w- c:\users\A\AppData\Local\GLFF24E.tmp
2009-08-29 22:05 . 2009-08-14 14:52 -------- d-----w- c:\users\A\AppData\Roaming\IDM
2009-08-29 17:09 . 2009-07-07 08:04 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-29 16:36 . 2009-07-07 07:52 -------- d-----w- c:\program files\Common Files\InstallShield
2009-08-23 13:56 . 2009-08-23 06:06 -------- d-----w- c:\program files\Wireless WEP Key Password Spy
2009-08-21 05:12 . 2009-08-21 05:10 -------- d-----w- c:\program files\Internet Download Manager
2009-08-19 03:31 . 2009-07-07 11:36 -------- d-----w- c:\users\A\AppData\Roaming\Skype
2009-08-18 19:36 . 2009-08-18 19:36 -------- d-----w- c:\program files\Circle Deveopement
2009-08-18 19:36 . 2009-08-18 19:36 -------- d-----w- c:\program files\Messenger Plus! Live
2009-08-18 18:36 . 2009-08-18 18:36 -------- d-----w- c:\users\A\AppData\Roaming\MOVAVI
2009-08-18 12:56 . 2009-08-18 12:56 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-08-18 12:38 . 2009-08-18 12:38 -------- d-----w- c:\program files\Common Files\Windows Live
2009-08-18 11:18 . 2009-08-16 16:34 -------- d-----w- c:\program files\MessengerDiscovery 2
2009-08-18 11:10 . 2009-08-18 11:10 62976 ----a-w- c:\windows\DTDraw.dll
2009-08-18 11:10 . 2009-08-18 11:10 -------- d-----w- c:\users\A\AppData\Roaming\DeskSoft
2009-08-15 17:51 . 2009-08-15 17:51 -------- d-----w- c:\programdata\Fighters
2009-08-15 17:51 . 2009-08-15 17:51 -------- d-----w- c:\program files\Fighters
2009-08-14 17:16 . 2009-09-10 00:06 213592 ----a-w- c:\windows\system32\drivers\netio.sys
2009-08-14 16:42 . 2009-09-10 00:06 167424 ----a-w- c:\windows\system32\tcpipcfg.dll
2009-08-14 16:40 . 2009-09-10 00:06 103936 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-14 16:40 . 2009-09-10 00:06 15360 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 14:25 . 2009-09-10 00:06 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:25 . 2009-09-10 00:06 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 14:25 . 2009-09-10 00:06 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 14:25 . 2009-09-10 00:06 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 14:25 . 2009-09-10 00:06 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 14:25 . 2009-09-10 00:06 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 14:25 . 2009-09-10 00:06 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-14 14:24 . 2009-09-10 00:06 813568 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 14:23 . 2009-09-10 00:06 22016 ----a-w- c:\windows\system32\netiougc.exe
2009-08-11 06:34 . 2009-08-11 06:34 -------- d-----w- c:\program files\MyWebSearch
2009-08-10 17:35 . 2009-08-10 17:35 -------- d-----w- c:\users\A\AppData\Roaming\ACD Systems
2009-08-10 17:31 . 2009-08-10 17:23 -------- d-----w- c:\program files\Common Files\ACD Systems
2009-08-10 17:23 . 2009-08-10 17:23 -------- d-----w- c:\programdata\ACD Systems
2009-08-10 17:23 . 2009-08-10 17:23 -------- d-----w- c:\program files\ACD Systems
2009-08-02 04:26 . 2009-08-02 04:26 -------- d-----w- c:\program files\Common Files\SWiSHzone.com
2009-07-31 18:27 . 2009-07-31 18:26 -------- d-----w- c:\users\A\AppData\Roaming\U3
2009-07-26 13:44 . 2009-07-26 13:44 48448 ----a-w- c:\windows\system32\sirenacm.dll
2009-07-25 05:10 . 2009-07-07 11:38 335752 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-07-18 12:17 . 2009-07-30 07:55 827392 ----a-w- c:\windows\system32\wininet.dll
2009-07-18 12:10 . 2009-07-30 07:56 56320 ----a-w- c:\windows\system32\iesetup.dll
2009-07-18 12:10 . 2009-07-30 07:55 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-07-18 12:07 . 2009-07-30 07:56 72704 ----a-w- c:\windows\system32\admparse.dll
2009-07-18 10:00 . 2009-07-30 07:55 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-18 08:34 . 2009-07-30 07:56 48128 ----a-w- c:\windows\system32\mshtmler.dll
2009-07-17 14:52 . 2009-08-13 10:08 71680 ----a-w- c:\windows\system32\atl.dll
2009-07-14 13:02 . 2009-08-13 10:22 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-14 13:01 . 2009-08-13 10:22 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-07-14 13:00 . 2009-08-13 10:22 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-07-14 11:11 . 2009-08-13 10:22 8147968 ----a-w- c:\windows\system32\wmploc.DLL
2009-07-10 22:47 . 2009-07-07 06:53 680 ----a-w- c:\users\A\AppData\Local\d3d9caps.dat
2009-07-10 10:07 . 2009-07-10 10:07 306544 ----a-w- c:\windows\WLXPGSS.SCR
2009-07-10 00:00 . 2009-07-10 00:00 268800 ----a-w- c:\windows\system32\es.dll
2009-07-08 22:21 . 2009-07-08 22:21 61440 ----a-w- c:\windows\system32\winipsec.dll
2009-07-08 22:21 . 2009-07-08 22:21 361984 ----a-w- c:\windows\system32\IPSECSVC.DLL
2009-07-08 22:21 . 2009-07-08 22:21 28672 ----a-w- c:\windows\system32\FwRemoteSvr.dll
2009-07-08 22:21 . 2009-07-08 22:21 272896 ----a-w- c:\windows\system32\polstore.dll
2009-07-08 22:19 . 2009-07-08 22:19 87040 ----a-w- c:\windows\system32\msoert2.dll
2009-07-08 22:19 . 2009-07-08 22:19 39424 ----a-w- c:\windows\system32\ACCTRES.dll
2009-07-08 22:19 . 2009-07-08 22:19 205824 ----a-w- c:\windows\system32\msoeacct.dll
2009-07-08 22:18 . 2009-07-08 22:18 704000 ----a-w- c:\windows\system32\PhotoScreensaver.scr
2009-07-08 22:18 . 2009-07-08 22:18 356352 ----a-w- c:\windows\system32\wbem\wbemcomn.dll
2009-07-08 22:18 . 2009-07-08 22:18 24064 ----a-w- c:\windows\system32\wtsapi32.dll
2009-07-08 22:18 . 2009-07-08 22:18 258232 ----a-w- c:\windows\system32\drivers\acpi.sys
2009-07-08 22:18 . 2009-07-08 22:18 20920 ----a-w- c:\windows\system32\drivers\compbatt.sys
2009-07-08 22:18 . 2009-07-08 22:18 11264 ----a-w- c:\windows\system32\drivers\wmiacpi.sys
2009-07-08 22:18 . 2009-07-08 22:18 28344 ----a-w- c:\windows\system32\drivers\battc.sys
2009-07-08 22:18 . 2009-07-08 22:18 14208 ----a-w- c:\windows\system32\drivers\CmBatt.sys
2009-07-08 22:18 . 2009-07-08 22:18 542720 ----a-w- c:\windows\system32\sysmain.dll
2009-07-08 22:17 . 2009-07-08 22:17 194560 ----a-w- c:\windows\system32\WebClnt.dll
2009-07-08 22:17 . 2009-07-08 22:17 110080 ----a-w- c:\windows\system32\drivers\mrxdav.sys
2009-07-08 22:17 . 2009-07-08 22:17 2028032 ----a-w- c:\windows\system32\win32k.sys
2009-07-08 22:16 . 2009-07-08 22:16 49664 ----a-w- c:\windows\system32\csrsrv.dll
2009-07-08 22:16 . 2009-07-08 22:16 376320 ----a-w- c:\windows\system32\winsrv.dll
2009-07-08 22:14 . 2009-07-08 22:14 376832 ----a-w- c:\windows\system32\winhttp.dll
2009-07-08 22:13 . 2009-07-08 22:13 297472 ----a-w- c:\windows\system32\gdi32.dll
2009-07-08 22:13 . 2009-07-08 22:13 41984 ----a-w- c:\windows\system32\drivers\monitor.sys
2009-07-08 22:13 . 2009-07-08 22:13 1060920 ----a-w- c:\windows\system32\drivers\ntfs.sys
2009-07-08 22:12 . 2009-07-08 22:12 211456 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2009-07-08 22:12 . 2009-07-08 22:12 500736 ----a-w- c:\windows\system32\msdtcprx.dll
2009-07-08 22:12 . 2009-07-08 22:12 30208 ----a-w- c:\windows\system32\xolehlp.dll
2009-07-08 22:10 . 2009-07-08 22:10 303616 ----a-w- c:\windows\system32\wmpeffects.dll
2009-07-08 22:09 . 2009-07-08 22:09 1194496 ----a-w- c:\windows\system32\msxml3.dll
2009-07-08 22:09 . 2009-07-08 22:09 2048 ----a-w- c:\windows\system32\msxml3r.dll
2009-07-08 22:09 . 2009-07-08 22:09 414208 ----a-w- c:\windows\system32\msscp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-26 1008896]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{346de098-61f9-4b42-89da-6dfba7091bb6}]
2009-07-15 07:09 2224152 ----a-w- c:\program files\IMBooster4web-en\tbIMBo.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}]
2009-06-05 14:33 104448 ----a-w- c:\program files\Iminent\SearchTheWeb\Iminent.BHO.NavigationError.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-06-26 07:36 1008896 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A6E9BAAF-53CD-4575-967B-2AF710A7D21F}]
2009-08-13 13:39 99840 ----a-w- c:\program files\Iminent\IMBooster\Iminent.LinkToContent.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-26 1008896]
"{346de098-61f9-4b42-89da-6dfba7091bb6}"= "c:\program files\IMBooster4web-en\tbIMBo.dll" [2009-07-15 2224152]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CLASSES_ROOT\clsid\{346de098-61f9-4b42-89da-6dfba7091bb6}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-26 1008896]
"{346DE098-61F9-4B42-89DA-6DFBA7091BB6}"= "c:\program files\IMBooster4web-en\tbIMBo.dll" [2009-07-15 2224152]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CLASSES_ROOT\clsid\{346de098-61f9-4b42-89da-6dfba7091bb6}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Vc Dupe"="c:\programdata\Atom Flaw Flaw.xw0y9m" [X]
"Amok Mode Dupe Platform"="c:\programdata\slow pure flag.1mvfh" [X]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-08 1232896]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-08-21 2815408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2009-07-08 1006264]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-10-09 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-09 8501792]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-09 81920]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-07 102400]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2007-10-17 768520]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-07 148888]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-07-07 1948440]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2009-05-20 111928]
"IMBooster"="c:\program files\Iminent\IMBooster\imbooster.exe" [2009-08-13 1328128]
"Iminent.Notifier"="c:\program files\Iminent\SearchTheWeb\Iminent.Notifier.exe" [2009-07-20 497664]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-07-06 4669440]
"Skytel"="Skytel.exe" - c:\windows\SkyTel.exe [2007-06-15 1826816]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-7-7 113664]
SnagIt 8.lnk - c:\program files\TechSmith\SnagIt 8\SnagIt32.exe [2007-5-1 6395464]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2345395917-4114030486-396801521-1000]
"EnableNotificationsRef"=dword:00000002
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{CA9BEC12-909D-437A-8737-FFC4A640AA21}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{8B42CF57-E159-4564-A560-F9915337D7C1}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{790C5DCC-1CA2-412F-A0A3-443756CB56E3}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{CA6C866F-9EC4-4B0C-BFF0-02A0DBEFB48A}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{CAD7F710-014E-4EA9-BA47-981AF4C00725}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{76BB7DBC-493D-4D03-91D5-E0C4CA8A29F3}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{D7CA1E14-0FD5-4905-AD94-E67B91C78CD2}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{570C2CD4-84DB-4CD2-9114-B7945CA446E0}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
"TCP Query User{5F38B2B2-0387-4E5D-BD55-F7481ACA3573}c:\\program files\\videolan\\vlc\\vlc.exe"= UDP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"UDP Query User{48CF982E-5749-4F39-87BF-94B695CFC1A4}c:\\program files\\videolan\\vlc\\vlc.exe"= TCP:c:\program files\videolan\vlc\vlc.exe:VLC media player
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [07/07/09 02:38 م 335752]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [07/07/09 02:38 م 108552]
R2 76084;76084;c:\windows\System32\76084.sys [07/07/09 09:56 ص 4096]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [07/07/09 02:38 م 298776]
R3 winbondcir;Winbond IR Transceiver;c:\windows\System32\drivers\winbondcir.sys [28/03/07 07:51 ص 43008]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [16/09/09 03:15 ص 54632]
S3 fsssvc;خدمة أمان العائلة في Windows Live;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/09 10:48 م 704864]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
.
Contents of the 'Scheduled Tasks' folder
2009-09-23 c:\windows\Tasks\SLOW-PCfighter.job
- c:\program files\Fighters\SLOW-PCfighter\SLOW-PCfighter.exe [2009-05-05 11:23]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
mStart Page = hxxp://home.sweetim.com
IE: &Search -
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
DPF: {B7FDB0C3-4724-46D2-B8DB-6FA1DC63F7CA} - hxxp://67.228.197.18:1999/ReadUid.CAB
.
- - - - ORPHANS REMOVED - - - -
URLSearchHooks-*{EEE6C35D-6118-11DC-9C72-001320C79847} - (no file)
URLSearchHooks-*{84FF7BD6-B47F-46F8-9130-01B2696B36CB} - (no file)
URLSearchHooks-*{346de098-61f9-4b42-89da-6dfba7091bb6} - (no file)
BHO-{EEE6C35C-6118-11DC-9C72-001320C79847} - (no file)
Toolbar-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
HKCU-Run-Device Detector - DevDetect.exe
HKLM-Run-MyWebSearch Plugin - c:\progra~1\MYWEBS~1\bar\2.bin\M3PLUGIN.DLL
HKLM-Run-My Web Search Bar Search Scope Monitor - c:\progra~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe
AddRemove-AVerMedia A310 (MiniCard - c:\program files\AVerMedia\AVerMedia A310 (MiniCard
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-09-23 07:41
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.032"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.abr"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.aif"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.aiff"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ani"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.arw"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.au"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bay"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bmp"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bw"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.cr2"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.crw"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.cs1"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.cur"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.dcr"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.dcx"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.dib"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.djv"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.djvu"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.dng"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.emf"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.eps"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.erf"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.fff"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.fpx"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2345395917-4114030486-396801521-1000)
"Progid"="ACDSee Pro 3.gif"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.hdr"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.icl"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.icn"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.iff"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ilbm"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.int"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.inta"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.iw4"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.j2c"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.j2k"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jbr"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jfif"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jif"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jp2"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jpc"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jpe"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jpeg"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2345395917-4114030486-396801521-1000)
"Progid"="ACDSee Pro 3.jpg"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jpk"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jpx"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.kdc"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.lbm"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.m1v"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.mef"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.mid"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.midi"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.mos"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.mp2"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.mpa"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.mpe"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.mpeg"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.mpg"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.mrw"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.nef"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.orf"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pbm"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pbr"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pcd"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pct"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pcx"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pef"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pgm"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pic"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pict"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pix"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2345395917-4114030486-396801521-1000)
"Progid"="ACDSee Pro 3.png"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ppm"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.psd"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.psp"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pspbrush"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pspimage"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.raf"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ras"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.raw"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rgb"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rgba"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rle"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rmi"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rsb"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rw2"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.sgi"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.sr2"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.srf"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.tga"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.thm"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.tif"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.tiff"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ttc"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ttf"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30po\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.v30po"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30pp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.v30pp"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30ppf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.v30ppf"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.wbm"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.wbmp"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.wmf"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xbm"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xif"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xmp"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xpm"
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000_Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"scansk"=hex(0):cd,6f,46,d1,8a,a1,aa,1c,3e,76,b6,f2,b8,4a,5f,4f,1a,c2,48,85,b6,
eb,e4,5a,d4,38,91,26,cd,bb,dd,ac,1d,dd,95,62,2a,2f,2b,d0,00,00,00,00,00,00,\
[HKEY_USERS\S-1-5-21-2345395917-4114030486-396801521-1000_Classes\CLSID\{f1888921-e21e-44e4-8f0c-2857b11dc1e4}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:000000e6
"Therad"=dword:0000001e
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,33,4f,4d,eb,39,8c,62,f6,37,4b,a3,49,b6,c2,fe,2e,97,c1,a4,7e,57,02,\
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-09-23 7:44
ComboFix-quarantined-files.txt 2009-09-23 04:44
Pre-Run: 9,944,211,456 bytes free
Post-Run: 15,484,411,904 bytes free
726 --- E O F --- 2009-09-22 05:42
