ComboFix 11-05-08.04 - Owner 09/05/2011 17:46:12.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1014.728 [GMT 1:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Owner\Application Data\Awraoh
c:\documents and settings\Owner\Application Data\Awraoh\adcu.exe
c:\documents and settings\Owner\Application Data\desktop.ini
c:\documents and settings\Owner\Application Data\ntuser.dat
.
.
((((((((((((((((((((((((( Files Created from 2011-04-09 to 2011-05-09 )))))))))))))))))))))))))))))))
.
.
2011-05-08 11:48 . 2011-05-09 16:33 -------- d-----w- c:\documents and settings\Owner\Application Data\Ulirmo
2011-05-05 21:25 . 2011-05-05 21:25 135680 ----a-w- c:\windows\system32\drivers\ethxylvf.sys
2011-05-05 21:22 . 2011-05-05 21:22 388096 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-05-05 21:22 . 2011-05-05 21:22 -------- d-----w- c:\program files\Trend Micro
2011-05-05 21:20 . 2011-05-05 21:20 -------- d-----w- c:\program files\Common Files\Java
2011-05-05 20:44 . 2011-05-05 20:44 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-05-05 20:35 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-05 20:35 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-05 20:32 . 2011-05-05 20:32 -------- d-----w- c:\program files\CCleaner
2011-05-05 19:19 . 2011-05-05 20:47 -------- d-----w- c:\documents and settings\All Users\Application Data\bL28601CaIgA28601
2011-05-05 18:49 . 2011-05-05 20:47 -------- d-----w- c:\documents and settings\Owner\Application Data\xfgkxer1hbbxwfxokvojijtyebjdow3k2
2011-05-05 18:46 . 2011-05-05 18:46 114176 --sha-r- c:\windows\system32\rpcns4H.dll
2011-05-05 18:46 . 2011-05-05 18:46 114176 --sha-r- c:\windows\system32\logonuiv.dll
2011-05-05 18:46 . 2011-05-05 18:46 114176 --sha-r- c:\windows\system32\ialmuTHAU.dll
2011-05-05 18:41 . 2011-04-11 07:04 7071056 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7C8C2A59-AC6B-4305-BF8F-AA42A1FBBBC0}\mpengine.dll
2011-04-29 12:34 . 2011-04-29 12:34 -------- d-----w- c:\windows\system32\wbem\Repository
2011-04-29 12:30 . 2011-04-29 12:33 -------- d-s---w- c:\documents and settings\Administrator
2011-04-29 06:43 . 2011-04-29 06:43 -------- d-----w- c:\documents and settings\Owner\Application Data\Sibelius Software
2011-04-28 23:18 . 2011-04-28 23:18 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2011-04-28 23:18 . 2011-04-28 23:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-04-28 23:18 . 2011-05-05 20:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-04-28 22:38 . 2011-04-28 22:38 -------- d-----w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2011-04-28 22:38 . 2011-05-08 11:50 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-04-25 15:51 . 2011-04-25 15:51 -------- d-----w- c:\program files\iPod
2011-04-25 15:51 . 2011-04-25 15:53 -------- d-----w- c:\program files\iTunes
2011-04-25 15:46 . 2011-04-25 15:46 -------- d-----w- c:\program files\Bonjour
2011-04-25 14:07 . 2011-04-25 14:07 -------- d-----r- C:\MSOCache
2011-04-25 13:59 . 2011-04-25 13:59 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\SoftGrid Client
2011-04-25 13:59 . 2011-05-09 16:43 -------- d-----w- c:\documents and settings\Owner\Application Data\SoftGrid Client
2011-04-25 13:59 . 2011-04-25 13:59 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\{90140011-0062-0409-0000-0000000FF1CE}
2011-04-25 13:59 . 2011-05-09 16:43 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\SoftGrid Client
2011-04-25 13:57 . 2011-04-25 13:57 -------- d-----w- c:\documents and settings\All Users\Microsoft
2011-04-25 13:57 . 2011-04-29 12:38 -------- d-----w- c:\program files\Microsoft Application Virtualization Client
2011-04-25 13:56 . 2011-04-25 14:01 -------- d-----w- c:\documents and settings\Owner\Application Data\TP
2011-04-18 21:13 . 2011-04-18 21:13 -------- d-----w- c:\documents and settings\Owner\Application Data\Amazon
2011-04-18 21:12 . 2011-04-18 21:12 -------- d-----w- c:\program files\Amazon
2011-04-17 14:07 . 2011-04-17 14:07 -------- d-----w- c:\windows\Sun
2011-04-16 14:29 . 2011-04-16 14:29 -------- d-----w- c:\documents and settings\Owner\Application Data\OpenOffice.org
2011-04-16 14:26 . 2011-04-16 14:26 -------- d-----w- c:\program files\OpenOffice.org 3
2011-04-16 14:25 . 2011-04-14 04:07 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-04-16 14:25 . 2011-04-14 01:40 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-04-16 14:25 . 2011-05-05 21:20 -------- d-----w- c:\program files\Java
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\RPRSTITL.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\RPRSTEXT.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\RPRSSTMP.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\RPRSSPEC.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\RPRSSCRP.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\RPRSREH_.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\RPRSMET_.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\RPRSCHOR.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\RPRS____.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\OPUSTEXT.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\OPUSSE__.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\OPUSS___.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\OPUSROMC.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\OPUSPC__.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\OPUSP___.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\OPUSO___.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\OPUSNN__.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\OPUSM___.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\OPUSFS__.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\OPUSFBE_.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\OPUSFB__.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\OPUSCSC_.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\OPUSCS__.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\OPUSC___.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\OPUS____.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\INKPEN2_.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\INK2TEXT.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\INK2SPEC.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\INK2SCRI.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\INK2METR.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\INK2CHOR.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\HELST___.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\HELSS___.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\HELSM___.FOT
2011-04-29 06:43 . 2011-04-29 06:43 1409 ----a-w- c:\windows\Fonts\HELSINKI.FOT
2011-04-11 07:04 . 2011-02-06 22:20 7071056 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-04-06 15:20 . 2011-04-06 15:20 91424 ----a-w- c:\windows\system32\dnssd.dll
2011-04-06 15:20 . 2011-04-06 15:20 75040 ----a-w- c:\windows\system32\jdns_sd.dll
2011-04-06 15:20 . 2011-04-06 15:20 197920 ----a-w- c:\windows\system32\dnssdX.dll
2011-04-06 15:20 . 2011-04-06 15:20 107808 ----a-w- c:\windows\system32\dns-sd.exe
2011-03-07 05:33 . 2011-01-11 19:25 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2004-08-04 10:00 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2004-08-04 10:00 1857920 ----a-w- c:\windows\system32\win32k.sys
2011-02-22 23:06 . 2006-03-04 03:33 916480 ----a-w- c:\windows\system32\wininet.dll
2011-02-22 23:06 . 2004-08-04 10:00 43520 ------w- c:\windows\system32\licmgr10.dll
2011-02-22 23:06 . 2004-08-04 10:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-02-22 11:41 . 2004-08-04 10:00 385024 ------w- c:\windows\system32\html.iec
2011-02-17 13:18 . 2004-08-04 10:00 455936 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2004-08-04 10:00 357888 ----a-w- c:\windows\system32\drivers\srv.sys
2011-02-17 12:32 . 2011-01-19 20:06 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2011-02-15 12:56 . 2004-08-04 10:00 290432 ----a-w- c:\windows\system32\atmfd.dll
2011-02-09 13:53 . 2004-08-04 10:00 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2004-08-04 10:00 186880 ----a-w- c:\windows\system32\encdec.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-05-08 2424192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 339968]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-02-18 49208]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
ykitl.exe [2011-5-8 284160]
.
c:\documents and settings\Owner\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17/02/2010 19:25 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/05/2010 19:41 67656]
R2 ASTRA32;ASTRA32 Kernel Driver 5.2.1.0;c:\program files\ASTRA32\astra32.sys [22/02/2007 12:28 30864]
R2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [28/02/2010 02:33 821664]
R2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [24/04/2010 01:10 483688]
R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfsxp.sys [02/12/2009 22:23 554344]
R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplayxp.sys [02/12/2009 22:23 211432]
R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirxp.sys [02/12/2009 22:23 20584]
R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvolxp.sys [02/12/2009 22:23 18280]
R3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [24/04/2010 01:10 209768]
S0 nwba;nwba;c:\windows\system32\drivers\fxufjr.sys --> c:\windows\system32\drivers\fxufjr.sys [?]
S1 ethxylvf;ethxylvf;c:\windows\system32\drivers\ethxylvf.sys [05/05/2011 22:25 135680]
S2 AMService;AMService;c:\windows\TEMP\kixd\setup.exe run --> c:\windows\TEMP\kixd\setup.exe run [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 14:16 130384]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [09/01/2010 21:37 4640000]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [04/08/2004 11:00 14336]
S3 WMZuneComm;Zune Windows Mobile Connectivity Service;f:\zune\WMZuneComm.exe --> f:\zune\WMZuneComm.exe [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 14:16 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-{4A29A5C9-E3D8-408B-4DBE-54A2258FA697} - c:\documents and settings\Owner\Application Data\Awraoh\adcu.exe
HKLM-Run-Zune Launcher - f:\zune\ZuneLauncher.exe
SafeBoot-WudfPf
SafeBoot-WudfRd
AddRemove-Zune - f:\zune\ZuneSetup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2011-05-09 17:53
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(644)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
Completion time: 2011-05-09 17:54:46
ComboFix-quarantined-files.txt 2011-05-09 16:54
.
Pre-Run: 486,545,432,576 bytes free
Post-Run: 488,234,688,512 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 16E3555B8274A30826B69815E5ADE5EE