API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Aug 7th, 2017
485
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 26.22 KB | None | 0 0
raw download clone embed print report
  1. ComboFix 11-03-28.03 - Asham_2 28/03/2011 23:09:28.1.4 - x64
  2. Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.4095.1894 [GMT -5:00]
  3. Running from: c:\users\Asham_2\Desktop\commy.exe
  4. AV: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
  5. SP: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
  6. SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {61CDFD9D-3CAC-9270-C6FC-52325ACB795B}
  7. SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
  8. .
  9. .
  10. ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
  11. .
  12. .
  13. c:\users\Asham_2\AppData\Roaming\Microsoft\Windows\Templates\GusEstrk.exe.exe
  14. c:\windows\SysWow64\uZQEtNDuIS.dll
  15. D:\install.exe
  16. .
  17. .
  18. ((((((((((((((((((((((((( Files Created from 2011-02-28 to 2011-03-29 )))))))))))))))))))))))))))))))
  19. .
  20. .
  21. 2011-03-29 04:21 . 2011-03-29 04:21 -------- d-----w- c:\users\Plutomi\AppData\Local\temp
  22. 2011-03-29 04:21 . 2011-03-29 04:21 -------- d-----w- c:\users\Plutomi.Asham-PC\AppData\Local\temp
  23. 2011-03-29 04:21 . 2011-03-29 04:21 -------- d-----w- c:\users\Guest\AppData\Local\temp
  24. 2011-03-29 04:21 . 2011-03-29 04:21 -------- d-----w- c:\users\Default\AppData\Local\temp
  25. 2011-03-29 04:21 . 2011-03-29 04:21 -------- d-----w- c:\users\Asham\AppData\Local\temp
  26. 2011-03-28 21:48 . 2011-03-28 21:48 -------- d-----w- c:\users\Asham_2\AppData\Local\Apple
  27. 2011-03-27 17:05 . 2011-03-27 17:05 -------- d-----w- c:\windows\system32\SPReview
  28. 2011-03-27 16:58 . 2010-11-20 13:33 1924480 ----a-w- c:\windows\system32\drivers\tcpip.sys
  29. 2011-03-27 16:57 . 2010-11-20 13:27 299520 ----a-w- c:\windows\system32\tsmf.dll
  30. 2011-03-27 16:56 . 2010-11-20 13:27 448000 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\tabskb.dll
  31. 2011-03-27 16:55 . 2010-11-20 13:27 215040 ----a-w- c:\windows\system32\wpdwcn.dll
  32. 2011-03-27 16:54 . 2010-11-20 12:21 189952 ----a-w- c:\windows\SysWow64\wdscore.dll
  33. 2011-03-27 16:54 . 2010-11-20 12:17 209920 ----a-w- c:\windows\SysWow64\PkgMgr.exe
  34. 2011-03-27 16:54 . 2010-11-20 12:18 323072 ----a-w- c:\windows\SysWow64\drvstore.dll
  35. 2011-03-27 16:54 . 2010-11-20 12:18 257024 ----a-w- c:\windows\SysWow64\dpx.dll
  36. 2011-03-27 16:54 . 2010-11-20 12:21 363008 ----a-w- c:\windows\SysWow64\wbemcomn.dll
  37. 2011-03-27 16:54 . 2010-11-20 12:19 606208 ----a-w- c:\windows\SysWow64\wbem\fastprox.dll
  38. 2011-03-27 16:50 . 2010-11-20 13:27 524288 ----a-w- c:\windows\system32\wmicmiplugin.dll
  39. 2011-03-27 16:50 . 2010-11-20 13:27 529408 ----a-w- c:\windows\system32\wbemcomn.dll
  40. 2011-03-27 16:50 . 2010-11-20 13:27 1225216 ----a-w- c:\windows\system32\wbem\wbemcore.dll
  41. 2011-03-27 16:50 . 2010-11-20 13:27 933376 ----a-w- c:\windows\system32\SmiEngine.dll
  42. 2011-03-27 16:50 . 2010-11-20 13:25 199168 ----a-w- c:\windows\system32\PkgMgr.exe
  43. 2011-03-27 16:49 . 2010-11-20 13:26 422912 ----a-w- c:\windows\system32\drvstore.dll
  44. 2011-03-27 16:49 . 2010-11-20 13:26 399872 ----a-w- c:\windows\system32\dpx.dll
  45. 2011-03-25 09:10 . 2011-03-15 05:17 8424784 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F5733992-F8FB-4597-B0B0-F7678964101E}\mpengine.dll
  46. 2011-03-14 18:35 . 2011-03-14 18:35 -------- d-----w- c:\users\Asham_2\AppData\Roaming\RoboForm
  47. .
  48. .
  49. (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  50. .
  51. 2011-03-28 22:36 . 2010-05-12 22:55 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
  52. 2011-03-27 17:15 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
  53. 2011-03-27 17:15 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
  54. 2011-02-02 23:11 . 2009-10-17 21:00 270720 ------w- c:\windows\system32\MpSigStub.exe
  55. 2011-01-08 19:40 . 2011-01-08 19:38 205984 ----a-w- c:\programdata\Microsoft\VBExpress\10.0\1033\ResourceCache.dll
  56. 2011-01-07 12:17 . 2011-02-22 20:25 475648 ----a-w- c:\windows\system32\XpsGdiConverter.dll
  57. 2011-01-07 12:17 . 2011-02-22 20:25 1465344 ----a-w- c:\windows\system32\XpsPrint.dll
  58. 2011-01-07 12:14 . 2011-02-12 15:22 46080 ----a-w- c:\windows\system32\atmlib.dll
  59. 2011-01-07 09:51 . 2011-02-12 15:24 1638912 ----a-w- c:\windows\system32\mshtml.tlb
  60. 2011-01-07 09:20 . 2011-02-12 15:22 366592 ----a-w- c:\windows\system32\atmfd.dll
  61. 2011-01-07 07:46 . 2011-02-22 20:25 870912 ----a-w- c:\windows\SysWow64\XpsPrint.dll
  62. 2011-01-07 07:46 . 2011-02-22 20:25 288256 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll
  63. 2011-01-07 07:45 . 2011-02-12 15:22 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
  64. 2011-01-07 06:01 . 2011-02-12 15:24 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb
  65. 2011-01-07 05:43 . 2011-02-12 15:22 294400 ----a-w- c:\windows\SysWow64\atmfd.dll
  66. 2011-01-05 10:34 . 2011-02-14 22:39 612864 ----a-w- c:\windows\system32\vbscript.dll
  67. 2011-01-05 06:56 . 2011-02-12 15:21 3129344 ----a-w- c:\windows\system32\win32k.sys
  68. 2011-01-05 05:55 . 2011-02-14 22:39 428032 ----a-w- c:\windows\SysWow64\vbscript.dll
  69. 2010-12-29 07:20 . 2010-12-29 07:20 709456 ----a-w- c:\windows\is-7DBTC.exe
  70. .
  71. .
  72. ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  73. .
  74. .
  75. *Note* empty entries & legit default entries are not shown
  76. REGEDIT4
  77. .
  78. [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
  79. @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
  80. [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
  81. 2008-07-29 21:52 121392 ----a-w- c:\program files (x86)\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
  82. .
  83. [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  84. "SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
  85. "msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-09-23 4240760]
  86. .
  87. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
  88. "Acer Assist Launcher"="c:\program files (x86)\Acer\Acer Assist\launcher.exe" [2007-11-19 1261568]
  89. "Acer Product Registration"="c:\program files (x86)\Acer\Acer Registration\ACE1.exe" [2007-11-26 3387392]
  90. "BkupTray"="c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-26 28672]
  91. "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2008-03-26 49152]
  92. "hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
  93. "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-01-22 40368]
  94. "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-12-21 443728]
  95. "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
  96. "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
  97. .
  98. c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
  99. HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
  100. .
  101. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
  102. "ConsentPromptBehaviorAdmin"= 0 (0x0)
  103. "ConsentPromptBehaviorUser"= 3 (0x3)
  104. "EnableLUA"= 0 (0x0)
  105. "EnableUIADesktopToggle"= 0 (0x0)
  106. "PromptOnSecureDesktop"= 0 (0x0)
  107. .
  108. [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
  109. "Explorer"= "c:\windows\Windows Firewall\winlogon.exe"
  110. .
  111. [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
  112. Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
  113. .
  114. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
  115. @=""
  116. .
  117. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
  118. @="Service"
  119. .
  120. R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
  121. R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
  122. R2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
  123. R2 MYYSQL;MYYSQL;c:\program files\MySQL\MySQL Server 5.1\bin\mysqld --defaults-file=c:\program files\MySQL\MySQL Server 5.1\my.ini MYYSQL [x]
  124. R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-26 131072]
  125. R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
  126. R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2009-09-26 4924336]
  127. R3 tapoas;TAP-Win32 Adapter OAS;c:\windows\system32\DRIVERS\tapoas.sys [x]
  128. R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
  129. R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
  130. R4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2010-07-05 1352832]
  131. R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files (x86)\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-10 47128]
  132. R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2008-07-10 369688]
  133. S0 ahcix64s;ahcix64s;c:\windows\system32\drivers\ahcix64s.sys [x]
  134. S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
  135. S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920]
  136. S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360]
  137. S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [x]
  138. S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [x]
  139. S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2010-06-29 128752]
  140. S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
  141. S2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384]
  142. S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2009-11-16 735960]
  143. S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x]
  144. S2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [2009-08-13 24576]
  145. S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2010-12-21 363344]
  146. S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~2\mcafee\SITEAD~1\mcsacore.exe [2011-02-16 101048]
  147. S2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-26 45056]
  148. S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
  149. S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2009-09-23 447848]
  150. S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2010-12-07 2228008]
  151. S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
  152. S3 sftfs;sftfs;c:\program files (x86)\Microsoft Application Virtualization Client\drivers\sftfslh.sys [2009-09-23 712536]
  153. S3 sftplay;sftplay;c:\program files (x86)\Microsoft Application Virtualization Client\drivers\sftplaylh.sys [2009-09-23 261480]
  154. S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
  155. S3 sftvol;sftvol;c:\program files (x86)\Microsoft Application Virtualization Client\drivers\sftvollh.sys [2009-09-23 17752]
  156. S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2009-09-23 203608]
  157. S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [x]
  158. S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
  159. S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
  160. .
  161. .
  162. --- Other Services/Drivers In Memory ---
  163. .
  164. *Deregistered* - KLBG
  165. *Deregistered* - KLIF
  166. .
  167. [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
  168. Hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
  169. getPlusHelper REG_MULTI_SZ getPlusHelper
  170. Akamai REG_MULTI_SZ Akamai
  171. .
  172. Contents of the 'Scheduled Tasks' folder
  173. .
  174. .
  175. --------- x86-64 -----------
  176. .
  177. .
  178. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
  179. @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
  180. [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
  181. 2008-07-29 21:53 50736 ----a-w- c:\program files (x86)\Acer\Empowering Technology\eDataSecurity\x64\PSDProtect.dll
  182. .
  183. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  184. "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-16 15940640]
  185. "RtHDVCpl"="RAVCpl64.exe" [2008-05-20 6296064]
  186. "Skytel"="Skytel.exe" [2007-11-20 1826816]
  187. "Acer Empowering Technology Monitor"="c:\program files\Acer\Empowering Technology\SysMonitor.exe" [2009-08-11 319488]
  188. "eDataSecurity Loader"="c:\program files (x86)\Acer\Empowering Technology\eDataSecurity\x64\eDSloader.exe" [2008-07-29 561200]
  189. "EmpoweringTechnology"="c:\program files\Acer\Empowering Technology\Framework.Launcher.exe" [2009-08-11 323584]
  190. "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-11-16 2716216]
  191. .
  192. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  193. "LoadAppInit_DLLs"=0x1
  194. .
  195. ------- Supplementary Scan -------
  196. .
  197. uLocal Page = c:\windows\system32\blank.htm
  198. uStart Page = hxxp://google.ca/
  199. mLocal Page = c:\windows\SysWOW64\blank.htm
  200. uInternet Settings,ProxyOverride = localhost; 127.0.0.1; <local>
  201. IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
  202. DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
  203. DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
  204. FF - ProfilePath - c:\users\Asham_2\AppData\Roaming\Mozilla\Firefox\Profiles\8i35eo4t.default\
  205. FF - prefs.js: browser.startup.homepage - google.ca
  206. FF - prefs.js: network.proxy.http - 24.121.163.45
  207. FF - prefs.js: network.proxy.http_port - 8090
  208. FF - prefs.js: network.proxy.type - 0
  209. FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
  210. FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
  211. FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
  212. FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
  213. FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com
  214. FF - Ext: FoxyProxy Standard: foxyproxy@eric.h.jung - %profile%\extensions\foxyproxy@eric.h.jung
  215. FF - Ext: FoxyProxy Basic: foxyproxy@eric.h.jung - %profile%\extensions\foxyproxy@eric.h.jung
  216. FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
  217. FF - Ext: ChatZilla: {59c81df5-4b7a-477b-912d-4e0fdf64e5f2} - %profile%\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}
  218. FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
  219. FF - Ext: Adobe DLM (powered by getPlus(R)): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
  220. FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
  221. FF - Ext: McAfee SiteAdvisor: {B7082FAA-CB62-4872-9106-E42DD88EDE45} - c:\program files (x86)\McAfee\SiteAdvisor
  222. FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(yahoo.ytff.general.dontshowhpoffer, true
  223. .
  224. - - - - ORPHANS REMOVED - - - -
  225. .
  226. BHO-{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - (no file)
  227. WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
  228. AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
  229. AddRemove-{20140062-0062-0409-0000-0000000FF1CE} - c:\program files (x86)\Common Files\microsoft shared\virtualization handler\cvhbs.exe
  230. AddRemove-.NET Reactor - c:\users\Asham_2\AppData\Local\{E6CA0070-F119-46D3-AFA3-A16FB84FEFA0}\dotnet_reactor_setup.exe
  231. AddRemove-{6732AE9F-CE1A-4DC7-A18D-A23CAA99724C} - c:\users\Asham_2\AppData\Local\{E6CA0070-F119-46D3-AFA3-A16FB84FEFA0}\dotnet_reactor_setup.exe
  232. .
  233. .
  234. .
  235. [HKEY_LOCAL_MACHINE\system\ControlSet001\services\MYYSQL]
  236. "ImagePath"="\"c:\program files\MySQL\MySQL Server 5.1\bin\mysqld\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.1\my.ini\" MYYSQL"
  237. .
  238. --------------------- LOCKED REGISTRY KEYS ---------------------
  239. .
  240. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
  241. @Denied: (A 2) (Everyone)
  242. @="FlashBroker"
  243. "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"
  244. .
  245. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
  246. "Enabled"=dword:00000001
  247. .
  248. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
  249. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"
  250. .
  251. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
  252. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  253. .
  254. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
  255. @Denied: (A 2) (Everyone)
  256. @="Shockwave Flash Object"
  257. .
  258. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
  259. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx"
  260. "ThreadingModel"="Apartment"
  261. .
  262. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
  263. @="0"
  264. .
  265. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
  266. @="ShockwaveFlash.ShockwaveFlash.10"
  267. .
  268. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  269. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx, 1"
  270. .
  271. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
  272. @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
  273. .
  274. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
  275. @="1.0"
  276. .
  277. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  278. @="ShockwaveFlash.ShockwaveFlash"
  279. .
  280. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
  281. @Denied: (A 2) (Everyone)
  282. @="Macromedia Flash Factory Object"
  283. .
  284. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
  285. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx"
  286. "ThreadingModel"="Apartment"
  287. .
  288. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
  289. @="FlashFactory.FlashFactory.1"
  290. .
  291. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  292. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx, 1"
  293. .
  294. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
  295. @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
  296. .
  297. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
  298. @="1.0"
  299. .
  300. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  301. @="FlashFactory.FlashFactory"
  302. .
  303. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
  304. @Denied: (A 2) (Everyone)
  305. @="IFlashBroker4"
  306. .
  307. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
  308. @="{00020424-0000-0000-C000-000000000046}"
  309. .
  310. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
  311. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  312. "Version"="1.0"
  313. .
  314. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}]
  315. @DACL=(02 0000)
  316. @="Folder Redirection"
  317. "ProcessGroupPolicyEx"="ProcessGroupPolicyEx"
  318. "DllName"=expand:"fdeploy.dll"
  319. "NoMachinePolicy"=dword:00000001
  320. "NoSlowLink"=dword:00000001
  321. "PerUserLocalSettings"=dword:00000001
  322. "NoGPOListChanges"=dword:00000000
  323. "NoBackgroundPolicy"=dword:00000000
  324. "GenerateGroupPolicy"="GenerateGroupPolicy"
  325. "EventSources"=multi:"(Folder Redirection,Application)\00\00"
  326. "DisplayName"=expand:"@fdeploy.dll,-261"
  327. .
  328. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
  329. @DACL=(02 0000)
  330. @="Microsoft Disk Quota"
  331. "DisplayName"=expand:"@%SystemRoot%\\System32\\dskquota.dll,-100"
  332. "NoMachinePolicy"=dword:00000000
  333. "NoUserPolicy"=dword:00000001
  334. "NoSlowLink"=dword:00000001
  335. "NoBackgroundPolicy"=dword:00000001
  336. "NoGPOListChanges"=dword:00000001
  337. "PerUserLocalSettings"=dword:00000000
  338. "RequiresSuccessfulRegistry"=dword:00000001
  339. "EnableAsynchronousProcessing"=dword:00000000
  340. "DllName"=expand:"%SystemRoot%\\System32\\dskquota.dll"
  341. "ProcessGroupPolicy"="ProcessGroupPolicy"
  342. .
  343. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}]
  344. @DACL=(02 0000)
  345. @="QoS Packet Scheduler"
  346. "DisplayName"=expand:"@gptext.dll,-201"
  347. "ProcessGroupPolicy"="ProcessPSCHEDPolicy"
  348. "DllName"=expand:"gptext.dll"
  349. "NoUserPolicy"=dword:00000001
  350. "NoGPOListChanges"=dword:00000001
  351. .
  352. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4bcd6cde-777b-48b6-9804-43568e23545d}]
  353. @DACL=(02 0000)
  354. @="Remote Desktop USB Redirection"
  355. "DllName"=expand:"%SystemRoot%\\System32\\TsUsbRedirectionGroupPolicyExtension.dll"
  356. "RequiresSuccessfulRegistry"=dword:00000001
  357. "ProcessGroupPolicyEx"="ProcessGroupPolicyEx"
  358. "NoGPOListChanges"=dword:00000001
  359. "NoUserPolicy"=dword:00000001
  360. "DisplayName"=expand:"@%SystemRoot%\\System32\\TsUsbRedirectionGroupPolicyExtension.dll,-100"
  361. "NoBackgroundPolicy"=dword:00000000
  362. .
  363. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7933F41E-56F8-41d6-A31C-4148A711EE93}]
  364. @DACL=(02 0000)
  365. @="Windows Search Group Policy Extension"
  366. "ProcessGroupPolicy"="ProcessGroupPolicy"
  367. "DllName"=expand:"%SystemRoot%\\System32\\srchadmin.dll"
  368. "RequiresSuccessfulRegistry"=dword:00000001
  369. "NoSlowLink"=dword:00000000
  370. "NoGPOListChanges"=dword:00000001
  371. "NoUserPolicy"=dword:00000000
  372. "NoMachinePolicy"=dword:00000000
  373. "PerUserLocalSettings"=dword:00000000
  374. "EnableAsynchronousProcessing"=dword:00000001
  375. "NoBackgroundPolicy"=dword:00000000
  376. .
  377. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{8A28E2C5-8D06-49A4-A08C-632DAA493E17}]
  378. @DACL=(02 0000)
  379. @="Deployed Printer Connections"
  380. "DisplayName"=expand:"@%systemroot%\\system32\\gpprnext.dll,-1"
  381. "DllName"=expand:"%systemroot%\\system32\\gpprnext.dll"
  382. "EnableAsynchronousProcessing"=dword:00000001
  383. "ExtensionEventSource"=""
  384. "GenerateGroupPolicy"="PrinterGenerateGroupPolicy"
  385. "MaxNoGPOListChangesInterval"=dword:00000000
  386. "NoBackgroundPolicy"=dword:00000000
  387. "NoGPOListChanges"=dword:00000000
  388. "NoMachinePolicy"=dword:00000000
  389. "NoSlowLink"=dword:00000001
  390. "NotifyLinkTransition"=dword:00000000
  391. "NoUserPolicy"=dword:00000000
  392. "PerUserLocalSettings"=dword:00000000
  393. "ProcessGroupPolicy"="PrinterProcessGroupPolicy"
  394. "ProcessGroupPolicyEx"="PrinterProcessGroupPolicyEx"
  395. "RequiresSuccessfulRegistry"=dword:00000000
  396. .
  397. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}]
  398. @DACL=(02 0000)
  399. @="TCPIP"
  400. "DisplayName"=expand:"@gptext.dll,-204"
  401. "ProcessGroupPolicy"="ProcessTCPIPPolicy"
  402. "DllName"=expand:"gptext.dll"
  403. "NoUserPolicy"=dword:00000001
  404. "NoGPOListChanges"=dword:00000001
  405. "RequiresSuccessfulRegistry"=dword:00000001
  406. .
  407. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}]
  408. @DACL=(02 0000)
  409. @="IP Security"
  410. "ProcessGroupPolicyEx"="ProcessIPSECPolicyEx"
  411. "GenerateGroupPolicy"="GenerateIPSECPolicy"
  412. "DllName"=expand:"%SystemRoot%\\System32\\polstore.dll"
  413. "NoUserPolicy"=dword:00000001
  414. "NoGPOListChanges"=dword:00000000
  415. "DisplayName"=expand:"@c:\\Windows\\system32\\polstore.dll,-5012"
  416. .
  417. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{f3ccc681-b74c-4060-9f26-cd84525dca2a}]
  418. @DACL=(02 0000)
  419. @="Audit Policy Configuration"
  420. "ProcessGroupPolicyEx"="ProcessGroupPolicyEx"
  421. "GenerateGroupPolicy"="GenerateGroupPolicy"
  422. "DllName"=expand:"auditcse.dll"
  423. "NoUserPolicy"=dword:00000001
  424. "EnableAsynchronousProcessing"=dword:00000001
  425. "MaxNoGPOListChangesInterval"=dword:000003c0
  426. "ForceRefreshFG"=dword:00000000
  427. .
  428. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{FB2CA36D-0B40-4307-821B-A13B252DE56C}]
  429. @DACL=(02 0000)
  430. @="Enterprise QoS"
  431. "DisplayName"=expand:"@gptext.dll,-203"
  432. "ProcessGroupPolicy"="ProcessEQoSPolicy"
  433. "DllName"=expand:"gptext.dll"
  434. "RequiresSuccessfulRegistry"=dword:00000001
  435. .
  436. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}]
  437. @DACL=(02 0000)
  438. @="CP"
  439. "DisplayName"=expand:"@gptext.dll,-205"
  440. "ProcessGroupPolicy"="ProcessConnectivityPlatformPolicy"
  441. "DllName"=expand:"gptext.dll"
  442. "NoUserPolicy"=dword:00000001
  443. "NoGPOListChanges"=dword:00000001
  444. "RequiresSuccessfulRegistry"=dword:00000001
  445. .
  446. [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
  447. @Denied: (Full) (Everyone)
  448. .
  449. Completion time: 2011-03-28 23:49:59
  450. ComboFix-quarantined-files.txt 2011-03-29 04:49
  451. .
  452. Pre-Run: 190,521,098,240 bytes free
  453. Post-Run: 190,476,345,344 bytes free
  454. .
  455. - - End Of File - - 178C90FAFD6EDADF114B3EBC1D5C00D4
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!