ComboFix 09-08-10.06 - maxime 11/08/2009 23:00.1.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.2046.1326 [GMT 2:00]
Running from: c:\users\maxime\Desktop\ComboFix.exe
SP: AVG Anti-Spyware *disabled* (Outdated) {48F2E28D-ED66-4646-9C11-B3055B0AF604}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-2435498850-2875804966-3608311380-500
c:\$recycle.bin\S-1-5-21-956900297-2972573597-628359832-500
c:\program files\Search Settings
c:\program files\Search Settings\kb127\SearchSettings.dll
c:\program files\Search Settings\kb127\SearchSettingsRes409.dll
c:\program files\Search Settings\SearchSettings.exe
c:\users\maxime\AppData\Local\goeockw.dat
c:\users\maxime\AppData\Local\goeockw_nav.dat
c:\users\maxime\AppData\Local\goeockw_navps.dat
c:\users\maxime\AppData\Local\zvidpcr.dat
c:\users\maxime\AppData\Local\zvidpcr_nav.dat
c:\users\maxime\AppData\Local\zvidpcr_navps.dat
c:\users\maxime\AppData\Roaming\02000000958919c4654C.manifest
c:\users\maxime\AppData\Roaming\02000000958919c4654O.manifest
c:\users\maxime\AppData\Roaming\02000000958919c4654P.manifest
c:\users\maxime\AppData\Roaming\02000000958919c4654S.manifest
c:\windows\Fonts\acrsecB.fon
c:\windows\Fonts\acrsecI.fon
c:\windows\Installer\1d1a687.msi
c:\windows\Installer\41e96b.msi
c:\windows\system32\9jBBHTCnwjYgA.vbs
c:\windows\system32\ddB0d.vbs
c:\windows\system32\FPoB1.vbs
c:\windows\system32\MVYY0FSlT50Na.vbs
c:\windows\system32\Mxc0vjsdr2B9A.vbs
c:\windows\system32\pxdrv.dll
c:\windows\system32\R1bIY.vbs
c:\windows\system32\vtyr6uTQSmZF9Ej.vbs
.
((((((((((((((((((((((((( Files Created from 2009-07-11 to 2009-08-11 )))))))))))))))))))))))))))))))
.
2009-08-11 21:07 . 2009-08-11 21:08 -------- d-----w- c:\users\maxime\AppData\Local\temp
2009-08-11 21:07 . 2009-08-11 21:07 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-08-11 19:57 . 2009-08-11 20:47 -------- d-sh--w- c:\windows\system32\SystemX86
2009-08-11 19:35 . 2009-08-11 20:51 -------- d-----w- C:\Karcher
2009-08-11 13:49 . 2009-08-11 13:49 -------- d-----w- c:\program files\trend micro
2009-08-11 13:49 . 2009-08-11 13:49 -------- d-----w- C:\rsit
2009-08-10 09:48 . 2009-08-10 09:48 120320 ----a-w- c:\windows\system32\d3dx9_3032.dll
2009-08-09 20:56 . 2009-08-09 20:56 -------- d-sh--w- c:\windows\ftpcache
2009-08-09 12:15 . 2009-08-09 12:18 -------- d-----w- c:\users\maxime\AppData\Roaming\Pro Cycling Manager 2009
2009-08-08 16:38 . 2009-08-08 16:38 -------- d-----w- c:\users\maxime\AppData\Roaming\Todae
2009-08-08 15:10 . 2009-08-08 15:10 -------- d-----w- c:\users\maxime\AppData\Roaming\BitTyrant
2009-08-08 12:10 . 2009-08-08 14:03 -------- d-----w- c:\program files\Azureus Ultra Accelerator
2009-08-08 12:03 . 2009-08-08 12:04 -------- d-----w- c:\program files\Vuze
2009-08-08 09:36 . 2009-08-08 09:53 -------- d-----w- c:\users\maxime\AppData\Roaming\GlarySoft
2009-08-08 09:23 . 2009-08-08 09:23 -------- d-----w- c:\program files\Glary Utilities
2009-08-05 11:51 . 2009-08-05 11:52 -------- d-----w- c:\windows\system32\URTTemp
2009-08-03 18:54 . 2009-08-03 18:54 -------- d-----w- c:\programdata\Google Updater
2009-07-23 12:04 . 2009-03-08 11:32 72704 ----a-w- c:\windows\system32\admparse.dll
2009-07-16 09:04 . 2009-06-15 15:24 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-07-16 09:04 . 2009-06-15 15:20 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-07-16 09:04 . 2009-06-15 15:20 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-07-16 09:04 . 2009-06-15 12:52 289792 ----a-w- c:\windows\system32\atmfd.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-11 21:05 . 2008-08-15 15:13 -------- d-----w- c:\users\maxime\AppData\Roaming\DNA
2009-08-11 20:51 . 2009-04-20 15:04 78730 ----a-w- c:\windows\system32\perfh00C.dat
2009-08-11 20:51 . 2009-04-20 15:04 25636 ----a-w- c:\windows\system32\perfc00C.dat
2009-08-11 20:45 . 2008-08-15 15:13 -------- d-----w- c:\program files\DNA
2009-08-11 20:45 . 2008-12-11 13:34 31966 ----a-w- c:\programdata\nvModes.dat
2009-08-11 20:45 . 2008-08-04 08:26 -------- d-----w- c:\program files\Alwil Software
2009-08-11 20:44 . 2007-08-23 13:23 836 ----a-w- c:\windows\bthservsdp.dat
2009-08-10 22:48 . 2008-02-13 14:01 -------- d-----w- c:\users\maxime\AppData\Roaming\Azureus
2009-08-10 22:40 . 2008-08-15 12:06 -------- d-----w- c:\users\maxime\AppData\Roaming\FrostWire
2009-08-10 16:24 . 2007-05-17 03:14 -------- d-----w- c:\program files\Google
2009-08-10 16:23 . 2007-05-17 02:20 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-10 12:25 . 2008-08-15 01:13 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-08-10 12:25 . 2008-08-15 01:13 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-08-10 12:21 . 2009-08-10 12:21 0 ----a-w- c:\windows\system32\2621.tmp
2009-08-09 21:37 . 2008-08-15 01:13 22328 ----a-w- c:\users\maxime\AppData\Roaming\PnkBstrK.sys
2009-08-09 21:37 . 2008-08-15 01:13 22328 ----a-w- c:\users\maxime\AppData\Roaming\PnkBstrK.sys
2009-08-08 10:24 . 2008-06-22 19:00 -------- d-----w- c:\program files\Ubisoft
2009-08-08 09:47 . 2008-12-24 09:59 -------- d-----w- c:\programdata\Media Center Programs
2009-08-08 09:31 . 2009-05-28 20:24 -------- d-----w- c:\program files\PCFriendly
2009-08-08 09:31 . 2008-02-03 13:01 -------- d-----w- c:\users\maxime\AppData\Roaming\uTorrent
2009-08-04 10:04 . 2008-12-11 13:34 -------- d-----w- c:\programdata\NVIDIA
2009-08-03 22:13 . 2009-06-09 12:26 -------- d-----w- c:\program files\Microsoft Silverlight
2009-07-21 21:52 . 2009-08-01 11:55 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-08-01 11:55 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-08-01 11:55 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-08-01 11:55 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-18 08:43 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-07-17 15:09 . 2008-01-21 10:44 10304 ----a-w- c:\users\maxime\AppData\Roaming\wklnhst.dat
2009-07-12 18:00 . 2009-06-09 15:57 -------- d-----w- c:\program files\Logitech
2009-07-12 18:00 . 2009-06-09 15:57 -------- d-----w- c:\program files\Common Files\Logishrd
2009-07-12 17:58 . 2009-04-19 13:15 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2009-07-12 08:15 . 2007-09-08 17:15 89336 ----a-w- c:\users\maxime\AppData\Local\GDIPFONTCACHEV1.DAT
2009-07-02 14:24 . 2009-05-11 15:00 -------- d-----w- c:\program files\Ubi Soft
2009-06-23 14:04 . 2009-06-23 14:04 -------- d-----w- c:\program files\Rockstar Games
2009-06-23 10:01 . 2007-05-17 02:57 -------- d-----w- c:\program files\Microsoft Works
2009-06-22 12:24 . 2007-05-17 02:58 -------- d-----w- c:\programdata\Microsoft Help
2009-06-17 14:57 . 2008-08-15 01:13 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-06-16 15:55 . 2009-06-16 15:55 1640 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2009-06-16 15:55 . 2009-06-16 15:55 -------- d-----w- c:\users\maxime\AppData\Roaming\Leadertech
2009-06-16 15:39 . 2009-06-16 15:39 -------- d-----w- c:\program files\EA Games
2009-06-03 16:05 . 2009-06-03 16:05 531 ----a-w- c:\windows\eReg.dat
2009-06-01 19:10 . 2009-06-01 19:10 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-05-27 14:04 . 2009-05-27 14:04 9850240 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2009-05-27 14:04 . 2009-05-27 14:04 7593472 ----a-w- c:\windows\system32\nvd3dum.dll
2009-05-27 14:04 . 2009-05-27 14:04 663552 ----a-w- c:\windows\system32\nvcuvid.dll
2009-05-27 14:04 . 2009-05-27 14:04 457248 ----a-w- c:\windows\system32\nvudisp.exe
2009-05-27 14:04 . 2009-05-27 14:04 3128320 ----a-w- c:\windows\system32\nvwgf2um.dll
2009-05-27 14:04 . 2009-05-27 14:04 1704960 ----a-w- c:\windows\system32\nvcuda.dll
2009-05-27 14:04 . 2009-05-27 14:04 143360 ----a-w- c:\windows\system32\nvcod151.dll
2009-05-27 14:04 . 2009-05-27 14:04 143360 ----a-w- c:\windows\system32\nvcod.dll
2009-05-27 14:04 . 2009-05-27 14:04 1314816 ----a-w- c:\windows\system32\nvcuvenc.dll
2009-05-27 14:04 . 2009-05-27 14:04 10366976 ----a-w- c:\windows\system32\nvoglv32.dll
2009-05-27 14:04 . 2007-05-01 10:27 983552 ----a-w- c:\windows\system32\nvapi.dll
2009-05-27 09:56 . 2007-05-01 10:27 457248 ----a-w- c:\windows\system32\nvuninst.exe
2009-05-25 12:50 . 2009-03-14 15:38 164864 ----a-w- c:\windows\system32\drivers\Rtlh86.sys
2009-05-15 13:14 . 2008-08-15 12:27 2621440 ----a-w- c:\users\maxime\AppData\Roaming\FrostWire\.NetworkShare\Incomplete\T-4506256-LimeWireWin4.16.6.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-06-10 318272]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-02-11 186904]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-05-27 13781536]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-03-09 4390912]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
"SearchSettings"=c:\program files\Search Settings\SearchSettings.exe
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"mylbx"=c:\program files\My Lockbox\mylbx.exe /a
"SMSERIAL"=c:\program files\Motorola\SMSERIAL\sm56hlpr.exe
"Windows Defender"=%ProgramFiles%\Windows Defender\MSASCui.exe -hide
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"DefaultOutboundAction"= 0 (0x0)
"DefaultInboundAction"= 1 (0x1)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{818E0A38-079E-400C-B235-BCBE9B8CB802}"= UDP:c:\program files\Internet Explorer\iexplore.exe:Internet Explorer
"{3F38B036-5234-484D-9559-611FF0812A0A}"= TCP:c:\program files\Internet Explorer\iexplore.exe:Internet Explorer
"{26114261-256A-4D7F-973C-C26BED2F8B03}"= UDP:c:\program files\Mindgames\1check\1check.exe:1check
"{53DEF82A-CA28-443F-8039-5DBF546EB601}"= TCP:c:\program files\Mindgames\1check\1check.exe:1check
"TCP Query User{D6B4F293-1931-4820-9F90-73EE0575307F}c:\\program files\\bitlord\\bitlord.exe"= UDP:c:\program files\bitlord\bitlord.exe:BitLord
"UDP Query User{887E810B-098E-4A7C-B6F4-1E864778FCD5}c:\\program files\\bitlord\\bitlord.exe"= TCP:c:\program files\bitlord\bitlord.exe:BitLord
"TCP Query User{7D3A9136-0746-4690-9A49-A3D00E8F66B4}c:\\program files\\ares\\ares.exe"= UDP:c:\program files\ares\ares.exe:Ares p2p for windows
"UDP Query User{B39EF2AD-8293-4B67-A2DE-4BA3B2E8BE3E}c:\\program files\\ares\\ares.exe"= TCP:c:\program files\ares\ares.exe:Ares p2p for windows
"{B88C2868-38DD-4BB0-B6F7-F654649F6612}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{779CE783-B6B0-439F-939E-6D4784E5708B}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{AF2EA9F1-866E-42EA-B55B-C1A690AE1022}"= UDP:c:\program files\Shareaza\Shareaza.exe:Shareaza
"{83CFBF03-5C6D-45BB-832C-F8263FD82B91}"= TCP:c:\program files\Shareaza\Shareaza.exe:Shareaza
"{A5C2F353-6508-4FBC-BD5D-C21DCB3B173B}"= UDP:4662:Em
"TCP Query User{5A652CEA-0D09-4523-A3EF-7147D7C198BB}c:\\program files\\msn messenger\\msnmsgr.exe"= UDP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"UDP Query User{65ADE028-DBD1-46A7-9EB9-437EE993DE07}c:\\program files\\msn messenger\\msnmsgr.exe"= TCP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"TCP Query User{9D54BAEE-CFD9-4552-B942-F1B4B1484F12}c:\\program files\\azureus\\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus
"UDP Query User{005FFC67-DDA6-4C3E-B23E-372E2EEC9FEB}c:\\program files\\azureus\\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus
"{F7A482C5-E6B9-4552-A90F-C579554979F1}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{BE91F734-13BF-4F98-AAA6-7D82A034AB0F}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{E4ECD157-17B6-4952-AD48-E50483F13D72}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{56DE244B-0087-48FC-A56E-3C697007B040}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{8D594605-9B2B-4BA3-8F9E-75F4DAA9DD2B}"= UDP:c:\program files\Ubisoft\Tom Clancy's Rainbow Six Vegas 2\Binaries\R6Vegas2_Game.exe:Tom Clancy's Rainbow Six Vegas 2
"{B02878BD-B716-43A8-8C3F-D3F7AF1D6F4E}"= TCP:c:\program files\Ubisoft\Tom Clancy's Rainbow Six Vegas 2\Binaries\R6Vegas2_Game.exe:Tom Clancy's Rainbow Six Vegas 2
"{303DE97A-E132-41AF-837B-50D257E722AC}"= UDP:c:\program files\Ubisoft\Tom Clancy's Rainbow Six Vegas 2\Binaries\R6Vegas2_Launcher.exe:Tom Clancy's Rainbow Six Vegas 2 Update
"{53273E0C-8DC8-4E41-83E3-D5175A55561C}"= TCP:c:\program files\Ubisoft\Tom Clancy's Rainbow Six Vegas 2\Binaries\R6Vegas2_Launcher.exe:Tom Clancy's Rainbow Six Vegas 2 Update
"{B9E48939-28DF-4BA8-AD40-FA52F5DE6F12}"= UDP:6346:Gnutella
"{52E4691A-476B-4BB5-9CF5-8957E15E87EF}"= TCP:6347:Gnutella
"{FCF2990E-E9E8-43A7-BB54-3C8A92691022}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire 4.14.8
"{F1AE6F8B-880D-4601-8E65-628C16831399}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire 4.14.8
"TCP Query User{4DD7C8D8-BE5D-438A-A8A2-1208DE7571B0}c:\\program files\\msn messenger\\msnmsgr.exe"= UDP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"UDP Query User{D05AEAA5-6041-4DD8-8313-4CA086ACE1EB}c:\\program files\\msn messenger\\msnmsgr.exe"= TCP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"TCP Query User{5733C414-D04E-48DB-AA13-C10F5F12BE3B}c:\\program files\\frostwire\\frostwire.exe"= UDP:c:\program files\frostwire\frostwire.exe:FrostWire
"UDP Query User{E865F16B-6F12-41EF-9B4F-DCB82FD14584}c:\\program files\\frostwire\\frostwire.exe"= TCP:c:\program files\frostwire\frostwire.exe:FrostWire
"{E645704C-2816-44B7-85E3-93793F2BF368}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{CF75CA4E-DB39-4F4A-9F0D-92F507AD4EF5}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{858E4D9C-6393-41C2-8730-6AE181C0AFCE}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{77F61E3A-76F6-4393-ADCB-49D7B04CA577}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{56CD2484-DD9E-4EC3-A250-5D9B87595B7E}c:\\program files\\bittorrent\\bittorrent.exe"= UDP:c:\program files\bittorrent\bittorrent.exe:bittorrent
"UDP Query User{4B441430-5C74-468A-A239-4014EB39E6C0}c:\\program files\\bittorrent\\bittorrent.exe"= TCP:c:\program files\bittorrent\bittorrent.exe:bittorrent
"TCP Query User{F3623B67-1CBD-4596-951D-E69DFB4E427A}c:\\users\\maxime\\program files\\dna\\btdna.exe"= UDP:c:\users\maxime\program files\dna\btdna.exe:btdna.exe
"UDP Query User{31D045D5-38D2-4987-830C-791381EE8CDE}c:\\users\\maxime\\program files\\dna\\btdna.exe"= TCP:c:\users\maxime\program files\dna\btdna.exe:btdna.exe
"TCP Query User{ED833C0E-118D-4BF6-B2D3-C4B7F57A2CEA}c:\\program files\\azureus\\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus
"UDP Query User{9633D036-C3B3-41A1-9BF5-91FC6B6B38B6}c:\\program files\\azureus\\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus
"TCP Query User{6804F820-CB98-48F9-A53E-293963DAD232}c:\\program files\\ubisoft\\tom clancy's splinter cell chaos theory\\system\\splintercell3.exe"= UDP:c:\program files\ubisoft\tom clancy's splinter cell chaos theory\system\splintercell3.exe:splintercell3
"UDP Query User{76E7D026-9E91-45C8-A498-489B1B292288}c:\\program files\\ubisoft\\tom clancy's splinter cell chaos theory\\system\\splintercell3.exe"= TCP:c:\program files\ubisoft\tom clancy's splinter cell chaos theory\system\splintercell3.exe:splintercell3
"TCP Query User{7153D870-D79C-47BC-B19B-3017924C65FB}c:\\program files\\frostwire\\frostwire.exe"= UDP:c:\program files\frostwire\frostwire.exe:FrostWire
"UDP Query User{D743DD99-E134-4275-85CC-96E49CA341D7}c:\\program files\\frostwire\\frostwire.exe"= TCP:c:\program files\frostwire\frostwire.exe:FrostWire
"TCP Query User{5DA7B20D-3B0A-47B7-8EC4-239880B5DFB1}c:\\program files\\ubisoft\\tom clancy's splinter cell double agent\\scda-offline\\system\\splintercell4.exe"= UDP:c:\program files\ubisoft\tom clancy's splinter cell double agent\scda-offline\system\splintercell4.exe:SplinterCell4
"UDP Query User{60204D85-1514-4490-9370-844748ADFB9C}c:\\program files\\ubisoft\\tom clancy's splinter cell double agent\\scda-offline\\system\\splintercell4.exe"= TCP:c:\program files\ubisoft\tom clancy's splinter cell double agent\scda-offline\system\splintercell4.exe:SplinterCell4
"TCP Query User{1EAA32D8-D900-48F4-B215-CCED6A651FD4}c:\\program files\\flashget\\flashget.exe"= UDP:c:\program files\flashget\flashget.exe:FlashGet
"UDP Query User{23181E73-5A53-4724-AC9B-81313E2A8A6D}c:\\program files\\flashget\\flashget.exe"= TCP:c:\program files\flashget\flashget.exe:FlashGet
"TCP Query User{99EB0BAC-97EC-4158-BE45-E39C7D3164AB}c:\\program files\\flashget\\flashget.exe"= UDP:c:\program files\flashget\flashget.exe:FlashGet
"UDP Query User{3ABE01A2-9409-4EB8-A267-C03B909E9BB9}c:\\program files\\flashget\\flashget.exe"= TCP:c:\program files\flashget\flashget.exe:FlashGet
"{9395EB18-827E-45DC-97D0-AC92252C2C72}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{834EC944-9B6A-4505-B8FB-045E9992BA77}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{082955FB-87AA-48B1-B2A0-A20AD73C9237}"= UDP:c:\program files\DNA\btdna.exe:DNA (TCP-In)
"{C1578F34-8DF9-4494-99B0-DAAFB86E3002}"= TCP:c:\program files\DNA\btdna.exe:DNA (UDP-In)
"{FB87382C-3A2F-4BE3-B5E2-0675CB6A58FA}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp
"{B62E7788-709D-470B-98D8-2FD69B37CDD9}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp
"TCP Query User{5D8A52EA-0E60-4303-A54E-259604DE0819}c:\\program files\\free download manager\\fdm.exe"= UDP:c:\program files\free download manager\fdm.exe:Free Download Manager
"UDP Query User{297349A4-5934-4605-9447-4BA17B4B0190}c:\\program files\\free download manager\\fdm.exe"= TCP:c:\program files\free download manager\fdm.exe:Free Download Manager
"{57107FAE-F2DF-4007-92CD-B750CEADF0CC}"= UDP:7777:TCP
"{CE4D2192-B671-465C-9203-13F8D58140E2}"= TCP:7777:UDP
"TCP Query User{37420B95-79C8-4E42-B8FF-5F0A96C5FC49}c:\\program files\\abc\\abc.exe"= UDP:c:\program files\abc\abc.exe:abc
"UDP Query User{AA6714E9-F49C-4E97-9EB2-75399C6251F6}c:\\program files\\abc\\abc.exe"= TCP:c:\program files\abc\abc.exe:abc
"{EE8B0D3D-4D5A-4425-BAC9-3E4F766F4F3E}"= UDP:6881:Azureus
"{DEE0BD7C-238B-4199-BF8F-A90EF95600CC}"= TCP:6881:Azureus
"{8BB2F95E-2657-457E-8AF6-2431746D337E}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{432EA22E-8F69-417F-A78F-6782A9ACD8C2}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{D179B79A-B901-41BA-9A74-52076610798B}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{0A54F943-999E-4033-BEE1-83B378E90ED4}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{8F584D7F-E4B7-4CDC-90CA-3FD2F9C2E7FE}"= UDP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9
"{1575866A-58D3-4E48-AFE2-231C54AEDE7C}"= TCP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9
"{9FDFB023-53EA-49DA-AD85-65CB538E2841}"= UDP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10
"{67E264F9-0F07-4E7B-A505-BC465165B6AE}"= TCP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10
"{CACBA0AB-4CC5-4841-BA07-12CD47C018C7}"= UDP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update
"{B2AE36BE-6B79-4F71-B8B6-AEA455437EC1}"= TCP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update
"{368E169D-D3A9-4A36-B523-9813931CD2C3}"= UDP:c:\program files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires 3
"{7673383A-E210-4D84-A022-8A00D92AFF92}"= TCP:c:\program files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires 3
"{FAB459A7-CDEB-415F-BEA2-BEB490ED88FB}"= UDP:c:\program files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires 3
"{407E5308-9D87-4367-9813-E9737E0E742D}"= TCP:c:\program files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires 3
"{83831427-427E-4AF3-BD1A-77C0BB47BA7A}"= UDP:c:\program files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe:BlueSoleilCS
"{4B020679-553E-4285-B975-32237D19110F}"= TCP:c:\program files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe:BlueSoleilCS
"{B57C9C27-A90F-4F80-B6C6-4FA5EA6160D1}"= UDP:c:\program files\Microsoft Games\Age of Empires III\age3x.exe:Age of Empires III - The WarChiefs
"{AC07452B-A0E9-47A4-BC51-A9AC1A5572D4}"= TCP:c:\program files\Microsoft Games\Age of Empires III\age3x.exe:Age of Empires III - The WarChiefs
"{99AB2268-FAAD-45DE-8AD3-05F108F2B7D2}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{3B2236BB-F063-41DF-B66E-1ED6A7ADF090}"= Disabled:UDP:c:\program files\Skype\Phone\Skype.exe:Skype
"{0B095F30-9EC7-4FEC-9865-611C5922243D}"= Disabled:TCP:c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{67E84EE7-5703-4BDE-803B-FA75B975766E}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype. The whole world can talk for free.
"UDP Query User{CC38CE07-7FB1-4053-AC15-D89D76017325}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype. The whole world can talk for free.
"{6891EE7D-C32C-4C2C-8B8C-8568A5BCD37A}"= UDP:c:\program files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:Grand Theft Auto IV
"{B0EFE346-C642-49B6-A113-8B904C51E305}"= TCP:c:\program files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:Grand Theft Auto IV
"TCP Query User{06B94159-2E24-47BE-A74B-CBF43FDA3D55}c:\\program files\\videolan\\vlc\\vlc.exe"= UDP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"UDP Query User{64C5C317-3679-4EDD-91C2-ECC241204056}c:\\program files\\videolan\\vlc\\vlc.exe"= TCP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"{8A386417-BDA3-43CF-9D40-4FEFF84E23E2}"= UDP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{C1AB810E-EFA0-4DFC-B55B-D0C18F80B257}"= TCP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"TCP Query User{57A3C4F3-354B-4058-B5A1-2846658668F4}c:\\program files\\vuze\\azureus.exe"= UDP:c:\program files\vuze\azureus.exe:Azureus
"UDP Query User{6312DA14-A52C-43B6-8390-A40A9F2850E7}c:\\program files\\vuze\\azureus.exe"= TCP:c:\program files\vuze\azureus.exe:Azureus
"{72EA3D48-24CE-4E03-A5AF-3EDDF6E61533}"= UDP:c:\program files\Cyanide\GameCenter\GameCenter.exe:GameCenter
"{C9F70871-9B41-4EDB-982D-6BE8B23BE58C}"= TCP:c:\program files\Cyanide\GameCenter\GameCenter.exe:GameCenter
"{E9418D82-0C88-46E1-BC38-834D5F23259F}"= UDP:c:\program files\Cyanide\Pro Cycling Manager - Season 2009\PCM.exe:Pro Cycling Manager - Season 2009
"{39AEA12C-9536-4331-AB6B-4A0C6FD17BF5}"= TCP:c:\program files\Cyanide\Pro Cycling Manager - Season 2009\PCM.exe:Pro Cycling Manager - Season 2009
"{74A57320-A0C7-43F0-B0A1-4F05D07F3AB1}"= UDP:c:\program files\Cyanide\Pro Cycling Manager - Season 2009\Autorun\Exe\Autorun.exe:Pro Cycling Manager - Season 2009 - AutoRun
"{A4570835-C0C6-4083-8EBC-A4B1A678323A}"= TCP:c:\program files\Cyanide\Pro Cycling Manager - Season 2009\Autorun\Exe\Autorun.exe:Pro Cycling Manager - Season 2009 - AutoRun
"TCP Query User{C54275FC-06FF-4809-837E-09DE48ABC50D}c:\\program files\\xfire\\xfire.exe"= UDP:c:\program files\xfire\xfire.exe:Xfire
"UDP Query User{472DD093-1CD7-46AA-890C-1FE99352F83B}c:\\program files\\xfire\\xfire.exe"= TCP:c:\program files\xfire\xfire.exe:Xfire
"TCP Query User{B47967BE-9553-47D0-A9E4-AE782F0FF469}c:\\program files\\xfire\\xfire.exe"= UDP:c:\program files\xfire\xfire.exe:Xfire
"UDP Query User{2655C97E-99DD-4C14-B18A-053F1C464A5F}c:\\program files\\xfire\\xfire.exe"= TCP:c:\program files\xfire\xfire.exe:Xfire
"TCP Query User{F98A7FDE-07A0-4FF5-9FF2-4CE18D875A60}c:\\program files\\valve\\counter-strike source\\hl2.exe"= UDP:c:\program files\valve\counter-strike source\hl2.exe:hl2
"UDP Query User{70E71AB8-16BA-491D-89B2-3701F0BB789D}c:\\program files\\valve\\counter-strike source\\hl2.exe"= TCP:c:\program files\valve\counter-strike source\hl2.exe:hl2
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
"DefaultOutboundAction"= 0 (0x0)
"DefaultInboundAction"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
R0 FSProFilter;FSPro File Filter;c:\windows\System32\drivers\FSPFltd.sys [19/04/2009 16:49 43792]
R2 fsproflt;FSPro Filter Service;c:\windows\System32\fsproflt.exe [19/04/2009 16:49 73344]
R2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE [30/03/2009 16:28 1533808]
R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\System32\drivers\ATSwpWDF.sys [02/10/2008 18:42 482176]
R3 NETw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [04/03/2009 10:49 4232704]
S2 gupdate1ca146bf70979ed;Service Google Update (gupdate1ca146bf70979ed);c:\program files\Google\Update\GoogleUpdate.exe [03/08/2009 20:55 133104]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [02/04/2009 17:12 55280]
S3 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 18:08 533360]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [29/05/2009 17:13 234864]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-08-11 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2009-08-08 08:30]
2009-08-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-08-03 18:54]
2009-08-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-03 18:55]
2009-08-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-03 18:55]
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{196C3A46-4758-433D-A600-802C804AF39C} - (no file)
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.orange.fr/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=73&bd=Pavilion&pf=laptop
IE: Download with &Shareaza - c:\program files\Shareaza\Plugins\RazaWebHook.dll/3000
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - c:\users\maxime\AppData\Roaming\Mozilla\Firefox\Profiles\gpflgrmd.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.sfr.fr/
FF - plugin: c:\program files\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-11 23:08
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-956900297-2972573597-628359832-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:4f,50,28,18,ae,89,6b,77,09,cb,0a,03,d8,0a,60,83,2b,b4,d7,a6,40,94,da,
fa,12,f2,f6,3f,60,97,6a,be,7c,b9,66,99,0a,9d,ee,1e,26,bd,0d,1f,51,7d,58,26,\
"??"=hex:74,be,eb,b9,02,f9,ca,a6,da,d7,3f,5b,be,62,3a,d7
[HKEY_USERS\S-1-5-21-956900297-2972573597-628359832-1000\Software\SecuROM\License information*]
@Allowed: (Read) (RestrictedCode)
"datasecu"=hex:2c,70,7e,01,f8,90,9a,0c,c0,ec,ab,c9,b4,a1,d3,d6,a9,7c,1e,2c,75,
9a,21,ab,b8,43,3b,e6,09,96,33,13,5e,ed,d2,03,56,2f,36,d7,93,d0,2d,81,f4,14,\
"rkeysecu"=hex:53,50,cc,f2,e3,54,e5,73,35,19,a1,5f,55,50,7c,8c
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:0000003d
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1248)
c:\windows\System32\d3dx9_3032.dll
- - - - - - - > 'lsass.exe'(776)
c:\windows\System32\d3dx9_3032.dll
.
Completion time: 2009-08-11 23:13
ComboFix-quarantined-files.txt 2009-08-11 21:13
Pre-Run: 40 955 568 128 octets libres
Post-Run: 40 343 347 200 octets libres
421 --- E O F --- 2009-08-03 21:34