ComboFix 12-09-18.02 - Sony 26-09-2012 13:07:37.2.4 - x64
Microsoft Windows 7 Home Basic 6.1.7600.0.1252.91.1033.18.2990.1700 [GMT 5.5:30]
Running from: c:\users\Sony\Desktop\svchost.exe.exe
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
- REDUCED FUNCTIONALITY MODE -
.
.
((((((((((((((((((((((((( Files Created from 2012-08-26 to 2012-09-26 )))))))))))))))))))))))))))))))
.
.
2012-09-26 07:38 . 2012-09-26 07:38 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-09-26 07:38 . 2012-09-26 07:38 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2012-09-25 10:29 . 2012-08-30 07:27 9308616 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{06378A3A-8386-46A6-899D-D9C6A458E9CD}\mpengine.dll
2012-09-24 05:28 . 2012-08-30 07:27 9308616 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-09-22 10:58 . 2012-09-22 10:58 -------- d-----w- c:\programdata\Kaspersky Lab
2012-09-22 06:38 . 2012-08-24 18:02 9375744 ----a-w- c:\windows\system32\mshtml.dll
2012-09-22 06:38 . 2012-08-24 18:01 12404736 ----a-w- c:\windows\system32\ieframe.dll
2012-09-22 06:38 . 2012-08-24 18:02 736256 ----a-w- c:\windows\system32\msfeeds.dll
2012-09-22 06:38 . 2012-08-24 18:05 1501696 ----a-w- c:\windows\system32\urlmon.dll
2012-09-22 06:38 . 2012-08-24 18:10 696424 ----a-w- c:\program files\Internet Explorer\iexplore.exe
2012-09-22 06:38 . 2012-08-24 17:15 672872 ----a-w- c:\program files (x86)\Internet Explorer\iexplore.exe
2012-09-22 06:13 . 2012-09-22 06:13 -------- d-----w- C:\Hotspot Shield
2012-09-22 06:13 . 2012-09-22 06:13 -------- d-----w- c:\program files (x86)\Hotspot Shield
2012-09-22 05:37 . 2012-09-22 05:37 -------- d-----w- c:\program files\Perfect Uninstaller
2012-09-20 17:55 . 2012-09-20 17:55 -------- d-----w- c:\program files (x86)\Conduit
2012-09-20 17:55 . 2012-09-20 17:55 -------- d-----w- c:\program files (x86)\ClixSense.com
2012-09-18 13:56 . 2012-09-18 13:56 -------- d-----w- c:\program files (x86)\Skillbrains
2012-09-18 13:54 . 2012-09-18 14:03 -------- d-----w- c:\program files (x86)\Opera
2012-09-16 07:20 . 2012-09-16 07:20 -------- d-----w- c:\program files (x86)\ESET
2012-09-14 14:15 . 2012-09-14 14:15 -------- d-----w- c:\programdata\Malwarebytes
2012-09-12 18:33 . 2012-09-12 18:33 -------- d-----w- c:\programdata\ArcSoft
2012-09-12 10:56 . 2012-09-12 10:56 286720 ----a-w- c:\windows\iun506.exe
2012-09-12 10:56 . 2012-09-12 10:56 -------- d-----w- c:\program files (x86)\Shipra's Dictionary
2012-09-09 11:37 . 2012-09-09 11:37 -------- d-----w- c:\windows\SysWow64\Hotspot Shield
2012-09-09 11:30 . 2012-09-09 11:30 -------- d-----w- c:\program files (x86)\VideoLAN
2012-09-05 12:51 . 2012-09-05 12:51 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2012-09-04 15:15 . 2012-09-12 12:09 64462936 ----a-w- c:\windows\system32\MRT.exe
2012-09-01 14:32 . 2012-09-01 14:32 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-09-01 14:32 . 2012-09-01 14:31 477168 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2012-09-01 14:31 . 2012-09-01 14:31 -------- d-----w- c:\program files (x86)\Java
2012-08-31 07:11 . 2011-04-28 03:58 552448 ----a-w- c:\windows\system32\drivers\bthport.sys
2012-08-31 07:11 . 2011-04-28 03:58 80384 ----a-w- c:\windows\system32\drivers\BTHUSB.SYS
2012-08-31 06:03 . 2012-09-04 15:20 -------- d-----w- c:\program files (x86)\Microsoft Works
2012-08-31 06:00 . 2012-08-31 06:00 -------- d-----w- c:\program files\Microsoft Office
2012-08-31 06:00 . 2012-08-31 06:00 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 8
2012-08-31 05:59 . 2012-08-31 06:02 -------- d-----w- c:\windows\SHELLNEW
2012-08-31 05:59 . 2012-09-12 12:10 -------- d-----w- c:\programdata\Microsoft Help
2012-08-31 05:59 . 2012-08-31 05:59 -------- d-----r- C:\MSOCache
2012-08-31 05:56 . 2012-08-31 05:57 -------- d-----w- c:\program files (x86)\OpenOffice.org 3
2012-08-31 05:49 . 2012-08-31 05:49 -------- d-----w- c:\program files\Google
2012-08-31 05:49 . 2012-08-31 06:11 -------- d-----w- c:\program files (x86)\Google
2012-08-30 07:43 . 2009-11-25 07:17 99176 ----a-w- c:\windows\SysWow64\PresentationHostProxy.dll
2012-08-30 07:43 . 2009-11-25 07:17 49472 ----a-w- c:\windows\SysWow64\netfxperf.dll
2012-08-30 07:43 . 2009-11-25 07:17 297808 ----a-w- c:\windows\SysWow64\mscoree.dll
2012-08-30 07:43 . 2009-11-25 07:17 295264 ----a-w- c:\windows\SysWow64\PresentationHost.exe
2012-08-30 07:43 . 2009-11-25 07:17 1130824 ----a-w- c:\windows\SysWow64\dfshim.dll
2012-08-30 07:43 . 2009-11-25 07:17 109912 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2012-08-30 07:43 . 2009-11-25 07:17 320352 ----a-w- c:\windows\system32\PresentationHost.exe
2012-08-30 07:43 . 2009-11-25 07:17 48960 ----a-w- c:\windows\system32\netfxperf.dll
2012-08-30 07:43 . 2009-11-25 07:17 444752 ----a-w- c:\windows\system32\mscoree.dll
2012-08-30 07:43 . 2009-11-25 07:17 1942856 ----a-w- c:\windows\system32\dfshim.dll
2012-08-30 06:22 . 2010-08-21 06:31 633856 ----a-w- c:\windows\system32\comctl32.dll
2012-08-30 06:22 . 2010-08-21 05:33 530432 ----a-w- c:\windows\SysWow64\comctl32.dll
2012-08-30 06:10 . 2011-10-01 05:28 886784 ----a-w- c:\program files\Common Files\System\wab32.dll
2012-08-30 06:10 . 2011-10-01 04:43 708608 ----a-w- c:\program files (x86)\Common Files\System\wab32.dll
2012-08-30 06:06 . 2011-04-09 06:58 142336 ----a-w- c:\windows\system32\poqexec.exe
2012-08-30 06:06 . 2011-04-09 05:56 123904 ----a-w- c:\windows\SysWow64\poqexec.exe
2012-08-30 06:04 . 2010-12-23 06:07 961024 ----a-w- c:\windows\system32\CPFilters.dll
2012-08-30 06:04 . 2010-12-23 05:28 642048 ----a-w- c:\windows\SysWow64\CPFilters.dll
2012-08-30 06:04 . 2010-12-23 06:07 1118720 ----a-w- c:\windows\system32\sbe.dll
2012-08-30 06:04 . 2010-12-23 06:02 259072 ----a-w- c:\windows\system32\mpg2splt.ax
2012-08-30 06:04 . 2010-12-23 05:28 850432 ----a-w- c:\windows\SysWow64\sbe.dll
2012-08-30 06:04 . 2010-12-23 05:24 199680 ----a-w- c:\windows\SysWow64\mpg2splt.ax
2012-08-30 06:03 . 2010-08-26 05:27 148992 ----a-w- c:\windows\system32\t2embed.dll
2012-08-30 06:03 . 2010-08-26 04:39 109056 ----a-w- c:\windows\SysWow64\t2embed.dll
2012-08-30 06:01 . 2011-10-26 05:22 1572864 ----a-w- c:\windows\system32\quartz.dll
2012-08-30 06:01 . 2011-10-26 04:28 1328640 ----a-w- c:\windows\SysWow64\quartz.dll
2012-08-30 05:59 . 2010-05-05 07:37 483840 ----a-w- c:\windows\system32\StructuredQuery.dll
2012-08-30 05:59 . 2011-07-09 02:44 287744 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2012-08-30 05:59 . 2011-05-04 02:51 157696 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2012-08-30 05:59 . 2011-05-04 02:51 126464 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2012-08-30 05:59 . 2010-05-05 06:46 363520 ----a-w- c:\windows\SysWow64\StructuredQuery.dll
2012-08-30 05:59 . 2011-11-17 07:12 395776 ----a-w- c:\windows\system32\webio.dll
2012-08-30 05:59 . 2011-11-17 05:39 314368 ----a-w- c:\windows\SysWow64\webio.dll
2012-08-30 05:59 . 2012-06-06 05:50 2003968 ----a-w- c:\windows\system32\msxml6.dll
2012-08-30 05:59 . 2012-06-06 05:50 1880064 ----a-w- c:\windows\system32\msxml3.dll
2012-08-30 05:59 . 2012-06-06 05:09 1389568 ----a-w- c:\windows\SysWow64\msxml6.dll
2012-08-30 05:59 . 2012-06-06 05:09 1236992 ----a-w- c:\windows\SysWow64\msxml3.dll
2012-08-30 05:58 . 2010-03-04 07:57 2080256 ----a-w- c:\program files\Windows Mail\msoe.dll
2012-08-30 05:58 . 2010-03-04 07:33 1619968 ----a-w- c:\program files (x86)\Windows Mail\msoe.dll
2012-08-30 05:57 . 2011-10-26 05:19 43520 ----a-w- c:\windows\system32\csrsrv.dll
2012-08-30 05:55 . 2011-03-11 06:19 1395712 ----a-w- c:\windows\system32\mfc42.dll
2012-08-30 05:55 . 2011-03-11 06:19 1359872 ----a-w- c:\windows\system32\mfc42u.dll
2012-08-30 05:55 . 2011-03-11 05:40 1164288 ----a-w- c:\windows\SysWow64\mfc42u.dll
2012-08-30 05:55 . 2011-03-11 05:40 1137664 ----a-w- c:\windows\SysWow64\mfc42.dll
2012-08-30 05:54 . 2012-06-09 05:30 14165504 ----a-w- c:\windows\system32\shell32.dll
2012-08-30 05:52 . 2011-04-29 03:13 461312 ----a-w- c:\windows\system32\drivers\srv.sys
2012-08-30 05:50 . 2011-11-17 07:14 1739160 ----a-w- c:\windows\system32\ntdll.dll
2012-08-30 05:50 . 2011-11-17 05:41 1292592 ----a-w- c:\windows\SysWow64\ntdll.dll
2012-08-30 05:28 . 2011-08-17 05:32 613888 ----a-w- c:\windows\system32\psisdecd.dll
2012-08-30 05:28 . 2011-08-17 05:27 288256 ----a-w- c:\windows\system32\MSNP.ax
2012-08-30 05:28 . 2011-08-17 05:27 108032 ----a-w- c:\windows\system32\psisrndr.ax
2012-08-30 05:28 . 2011-08-17 04:26 465408 ----a-w- c:\windows\SysWow64\psisdecd.dll
2012-08-30 05:28 . 2011-08-17 04:22 75776 ----a-w- c:\windows\SysWow64\psisrndr.ax
2012-08-30 05:28 . 2011-08-17 05:27 75776 ----a-w- c:\windows\system32\MSDvbNP.ax
2012-08-30 05:28 . 2011-08-17 05:27 104960 ----a-w- c:\windows\system32\Mpeg2Data.ax
2012-08-30 05:28 . 2011-08-17 04:22 72704 ----a-w- c:\windows\SysWow64\Mpeg2Data.ax
2012-08-30 05:28 . 2011-08-17 04:22 59904 ----a-w- c:\windows\SysWow64\MSDvbNP.ax
2012-08-30 05:28 . 2011-08-17 04:22 204288 ----a-w- c:\windows\SysWow64\MSNP.ax
2012-08-30 05:25 . 2012-04-28 03:50 204800 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-08-30 05:24 . 2010-10-12 05:05 35328 ----a-w- c:\program files\Windows Mail\wabfind.dll
2012-08-30 05:24 . 2010-10-12 05:00 516096 ----a-w- c:\program files\Windows Mail\wab.exe
2012-08-30 05:24 . 2010-10-12 04:25 516096 ----a-w- c:\program files (x86)\Windows Mail\wab.exe
2012-08-30 05:24 . 2011-12-28 03:59 499200 ----a-w- c:\windows\system32\drivers\afd.sys
2012-08-30 05:24 . 2012-03-17 07:55 75632 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-08-30 05:20 . 2012-07-04 21:23 41472 ----a-w- c:\windows\SysWow64\browcli.dll
2012-08-30 05:20 . 2012-07-04 22:04 73216 ----a-w- c:\windows\system32\netapi32.dll
2012-08-30 05:20 . 2012-07-04 22:01 58880 ----a-w- c:\windows\system32\browcli.dll
2012-08-30 05:20 . 2012-07-04 22:01 136704 ----a-w- c:\windows\system32\browser.dll
2012-08-30 05:14 . 2011-12-16 08:42 634368 ----a-w- c:\windows\system32\msvcrt.dll
2012-08-30 05:14 . 2011-12-16 07:59 690688 ----a-w- c:\windows\SysWow64\msvcrt.dll
2012-08-30 05:13 . 2010-10-16 05:23 112000 ----a-w- c:\windows\system32\consent.exe
2012-08-30 05:13 . 2012-07-18 17:31 3146752 ----a-w- c:\windows\system32\win32k.sys
2012-08-30 05:11 . 2012-05-14 05:20 956416 ----a-w- c:\windows\system32\localspl.dll
2012-08-30 05:11 . 2011-02-23 05:15 90624 ----a-w- c:\windows\system32\drivers\bowser.sys
2012-08-30 05:11 . 2011-08-27 05:40 861184 ----a-w- c:\windows\system32\oleaut32.dll
2012-08-30 05:11 . 2011-08-27 05:40 331776 ----a-w- c:\windows\system32\oleacc.dll
2012-08-30 05:11 . 2011-08-27 04:43 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2012-08-30 05:11 . 2011-08-27 04:43 233472 ----a-w- c:\windows\SysWow64\oleacc.dll
2012-08-30 05:11 . 2011-10-15 06:25 723456 ----a-w- c:\windows\system32\EncDec.dll
2012-08-30 05:11 . 2011-10-15 05:48 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
2012-08-30 05:10 . 2011-11-05 05:17 2048 ----a-w- c:\windows\system32\tzres.dll
2012-08-30 05:10 . 2011-11-05 04:30 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2012-08-30 05:10 . 2012-03-30 11:09 1895280 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-08-30 05:09 . 2010-10-16 05:17 720896 ----a-w- c:\windows\system32\odbc32.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-13 12:49 . 2009-08-18 19:49 564632 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\wlidui.dll
2012-09-13 12:48 . 2009-08-18 18:24 19720 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-08-29 01:16 . 2012-08-29 01:16 2560 ----a-w- c:\windows\SysWow64\drivers\en-US\qwavedrv.sys.mui
2012-08-29 01:15 . 2012-08-29 01:15 25600 ----a-w- c:\windows\SysWow64\drivers\en-US\bfe.dll.mui
2012-08-29 01:15 . 2012-08-29 01:15 15360 ----a-w- c:\windows\SysWow64\drivers\en-US\pacer.sys.mui
2012-08-29 01:15 . 2012-08-29 01:15 2560 ----a-w- c:\windows\SysWow64\drivers\en-US\scfilter.sys.mui
2012-08-29 01:15 . 2012-08-29 01:15 5632 ----a-w- c:\windows\SysWow64\drivers\en-US\ndiscap.sys.mui
2012-08-29 01:15 . 2012-08-29 01:15 44032 ----a-w- c:\windows\SysWow64\drivers\en-US\tcpip.sys.mui
2012-08-01 18:13 . 2012-08-01 18:13 41704 ----a-w- c:\windows\system32\drivers\hssdrv6.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2012-09-18_10.20.40 )))))))))))))))))))))))))))))))))))))))))
.
- 2012-08-30 05:19 . 2012-06-27 06:01 67584 c:\windows\SysWOW64\mshtmled.dll
+ 2012-09-22 06:37 . 2012-08-24 17:09 67584 c:\windows\SysWOW64\mshtmled.dll
+ 2012-09-22 06:37 . 2012-08-24 17:06 12800 c:\windows\SysWOW64\msfeedssync.exe
- 2012-08-30 05:19 . 2012-06-27 05:58 12800 c:\windows\SysWOW64\msfeedssync.exe
+ 2012-09-22 06:37 . 2012-08-24 17:09 64512 c:\windows\SysWOW64\msfeedsbs.dll
- 2012-08-30 05:19 . 2012-06-27 06:01 64512 c:\windows\SysWOW64\msfeedsbs.dll
+ 2012-09-22 06:37 . 2012-08-24 17:10 68608 c:\windows\SysWOW64\migration\WininetPlugin.dll
- 2012-08-30 05:19 . 2012-06-27 06:03 68608 c:\windows\SysWOW64\migration\WininetPlugin.dll
+ 2011-09-08 10:47 . 2011-09-08 10:47 81744 c:\windows\SysWOW64\mfcm100u.dll
+ 2011-06-10 20:28 . 2011-06-10 20:28 81744 c:\windows\SysWOW64\mfcm100.dll
+ 2012-09-22 06:37 . 2012-08-24 17:08 44544 c:\windows\SysWOW64\licmgr10.dll
- 2012-08-30 05:19 . 2012-06-27 06:01 44544 c:\windows\SysWOW64\licmgr10.dll
+ 2012-09-22 06:37 . 2012-08-24 17:08 48128 c:\windows\SysWOW64\jsproxy.dll
- 2012-08-30 05:19 . 2012-06-27 06:01 48128 c:\windows\SysWOW64\jsproxy.dll
- 2009-07-14 04:54 . 2012-09-18 09:55 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2012-09-26 04:45 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2012-09-26 04:45 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-09-18 09:55 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-09-18 09:55 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-09-26 04:45 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-07-30 22:19 . 2012-09-26 04:47 51216 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-09-26 04:47 33170 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2012-08-30 05:19 . 2012-06-27 06:59 97792 c:\windows\system32\mshtmled.dll
+ 2012-09-22 06:37 . 2012-08-24 18:02 97792 c:\windows\system32\mshtmled.dll
+ 2012-09-22 06:37 . 2012-08-24 17:59 12288 c:\windows\system32\msfeedssync.exe
- 2012-08-30 05:19 . 2012-06-27 06:55 12288 c:\windows\system32\msfeedssync.exe
+ 2012-09-22 06:37 . 2012-08-24 18:02 82944 c:\windows\system32\msfeedsbs.dll
- 2012-08-30 05:19 . 2012-06-27 06:59 82944 c:\windows\system32\msfeedsbs.dll
- 2012-08-30 05:19 . 2012-06-27 07:03 95232 c:\windows\system32\migration\WininetPlugin.dll
+ 2012-09-22 06:37 . 2012-08-24 18:05 95232 c:\windows\system32\migration\WininetPlugin.dll
+ 2011-09-08 10:48 . 2011-09-08 10:48 93008 c:\windows\system32\mfcm100u.dll
+ 2011-09-08 10:48 . 2011-09-08 10:48 93008 c:\windows\system32\mfcm100.dll
- 2012-08-30 05:19 . 2012-06-27 06:59 57856 c:\windows\system32\licmgr10.dll
+ 2012-09-22 06:37 . 2012-08-24 18:02 57856 c:\windows\system32\licmgr10.dll
- 2012-08-30 05:19 . 2012-06-27 06:58 64512 c:\windows\system32\jsproxy.dll
+ 2012-09-22 06:37 . 2012-08-24 18:02 64512 c:\windows\system32\jsproxy.dll
+ 2009-07-14 05:30 . 2012-09-22 06:13 86016 c:\windows\system32\DriverStore\infpub.dat
- 2009-07-14 05:30 . 2012-09-02 03:19 86016 c:\windows\system32\DriverStore\infpub.dat
+ 2011-05-24 23:40 . 2011-05-24 23:40 56832 c:\windows\system32\drivers\HssDrv.sys
- 2012-08-29 00:22 . 2012-09-18 09:58 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2012-08-29 00:22 . 2012-09-26 04:49 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2012-08-29 00:22 . 2012-09-26 04:49 49152 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-09-26 04:49 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2012-09-18 09:58 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:46 . 2012-09-23 05:37 63688 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
- 2012-08-29 07:33 . 2012-09-18 10:12 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2012-08-29 07:33 . 2012-09-26 07:08 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2012-08-29 07:33 . 2012-09-18 10:12 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2012-08-29 07:33 . 2012-09-26 07:08 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2012-09-22 17:38 . 2012-09-22 17:38 3700 c:\windows\system32\wdi\ERCQueuedResolutions.dat
+ 2012-08-29 05:21 . 2012-09-26 04:47 6466 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2509696765-2458900523-3203626048-1000_UserData.bin
- 2012-09-18 09:55 . 2012-09-18 09:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-09-26 04:45 . 2012-09-26 04:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-09-26 04:45 . 2012-09-26 04:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-09-18 09:55 . 2012-09-18 09:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-09-22 06:37 . 2012-08-24 17:10 981504 c:\windows\SysWOW64\wininet.dll
- 2012-08-30 05:19 . 2012-06-27 06:03 981504 c:\windows\SysWOW64\wininet.dll
- 2012-08-30 05:19 . 2012-06-27 06:03 132096 c:\windows\SysWOW64\url.dll
+ 2012-09-22 06:37 . 2012-08-24 17:10 132096 c:\windows\SysWOW64\url.dll
+ 2011-09-08 10:47 . 2011-09-08 10:47 773968 c:\windows\SysWOW64\msvcr100.dll
- 2010-03-18 16:15 . 2010-03-18 16:15 421200 c:\windows\SysWOW64\msvcp100.dll
+ 2011-09-08 10:47 . 2011-09-08 10:47 421200 c:\windows\SysWOW64\msvcp100.dll
+ 2012-09-22 06:37 . 2012-08-24 17:09 606208 c:\windows\SysWOW64\mstime.dll
- 2012-08-30 05:19 . 2012-06-27 06:01 606208 c:\windows\SysWOW64\mstime.dll
- 2012-08-30 05:19 . 2012-06-27 06:01 627200 c:\windows\SysWOW64\msfeeds.dll
+ 2012-09-22 06:37 . 2012-08-24 17:09 627200 c:\windows\SysWOW64\msfeeds.dll
- 2012-08-30 05:19 . 2012-06-27 06:01 176640 c:\windows\SysWOW64\ieui.dll
+ 2012-09-22 06:37 . 2012-08-24 17:08 176640 c:\windows\SysWOW64\ieui.dll
+ 2012-09-22 06:37 . 2012-08-24 17:08 185856 c:\windows\SysWOW64\iepeers.dll
- 2012-08-30 05:19 . 2012-06-27 06:00 185856 c:\windows\SysWOW64\iepeers.dll
+ 2012-09-22 06:37 . 2012-08-24 17:08 381440 c:\windows\SysWOW64\iedkcs32.dll
- 2012-08-30 05:19 . 2012-06-27 06:00 381440 c:\windows\SysWOW64\iedkcs32.dll
- 2010-03-18 16:15 . 2010-03-18 16:15 138056 c:\windows\SysWOW64\atl100.dll
+ 2011-09-08 10:47 . 2011-09-08 10:47 138056 c:\windows\SysWOW64\atl100.dll
+ 2012-08-28 13:30 . 2012-09-22 14:10 191278 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2012-09-22 06:37 . 2012-08-24 18:05 134144 c:\windows\system32\url.dll
- 2012-08-30 05:19 . 2012-06-27 07:03 134144 c:\windows\system32\url.dll
- 2009-07-14 02:36 . 2012-09-18 06:25 621742 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-09-22 10:53 621742 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-09-22 10:53 108792 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2012-09-18 06:25 108792 c:\windows\system32\perfc009.dat
+ 2011-09-08 10:48 . 2011-09-08 10:48 829264 c:\windows\system32\msvcr100.dll
+ 2011-09-08 10:48 . 2011-09-08 10:48 608080 c:\windows\system32\msvcp100.dll
+ 2012-09-22 06:37 . 2012-08-24 18:01 247808 c:\windows\system32\ieui.dll
- 2012-08-30 05:19 . 2012-06-27 06:58 247808 c:\windows\system32\ieui.dll
+ 2012-09-22 06:37 . 2012-08-24 18:01 256000 c:\windows\system32\iepeers.dll
- 2012-08-30 05:19 . 2012-06-27 06:58 256000 c:\windows\system32\iepeers.dll
+ 2012-09-22 06:37 . 2012-08-24 18:01 445952 c:\windows\system32\iedkcs32.dll
- 2012-08-30 05:19 . 2012-06-27 06:58 445952 c:\windows\system32\iedkcs32.dll
+ 2009-07-14 05:30 . 2012-09-22 06:13 143360 c:\windows\system32\DriverStore\infstrng.dat
- 2009-07-14 05:30 . 2012-09-02 03:19 143360 c:\windows\system32\DriverStore\infstrng.dat
+ 2009-07-14 05:12 . 2012-09-22 10:18 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-07-14 05:12 . 2012-08-30 10:16 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2011-09-08 10:48 . 2011-09-08 10:48 158536 c:\windows\system32\atl100.dll
- 2010-03-18 16:36 . 2010-03-18 16:36 158536 c:\windows\system32\atl100.dll
- 2009-07-14 05:01 . 2012-09-18 07:36 484284 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-09-25 16:10 484284 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2012-09-22 06:38 . 2012-08-24 17:10 1230848 c:\windows\SysWOW64\urlmon.dll
+ 2012-09-22 06:38 . 2012-08-24 17:09 6029824 c:\windows\SysWOW64\mshtml.dll
+ 2011-09-08 10:47 . 2011-09-08 10:47 4422992 c:\windows\SysWOW64\mfc100u.dll
+ 2011-09-08 10:47 . 2011-09-08 10:47 4397384 c:\windows\SysWOW64\mfc100.dll
- 2012-08-30 05:19 . 2012-06-27 06:01 2072576 c:\windows\SysWOW64\iertutil.dll
+ 2012-09-22 06:37 . 2012-08-24 17:08 2072576 c:\windows\SysWOW64\iertutil.dll
+ 2012-09-22 06:37 . 2012-08-24 18:05 1197568 c:\windows\system32\wininet.dll
- 2012-08-30 05:19 . 2012-06-27 07:03 1197568 c:\windows\system32\wininet.dll
+ 2009-07-14 02:34 . 2012-09-26 05:00 9961472 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
- 2009-07-14 02:34 . 2012-09-18 05:26 9961472 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
+ 2012-09-22 06:37 . 2012-08-24 18:03 1026560 c:\windows\system32\mstime.dll
- 2012-08-30 05:19 . 2012-06-27 07:00 1026560 c:\windows\system32\mstime.dll
+ 2011-06-10 19:45 . 2011-06-10 19:45 5601616 c:\windows\system32\mfc100u.dll
+ 2011-09-08 10:48 . 2011-09-08 10:48 5574984 c:\windows\system32\mfc100.dll
+ 2012-09-22 06:37 . 2012-08-24 18:01 2458624 c:\windows\system32\iertutil.dll
- 2012-08-30 05:19 . 2012-06-27 06:58 2458624 c:\windows\system32\iertutil.dll
- 2009-07-14 04:45 . 2012-09-12 10:10 3375473 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
+ 2009-07-14 04:45 . 2012-09-22 10:19 3375473 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
+ 2012-02-16 09:07 . 2012-02-16 09:07 1410048 c:\windows\Installer\24cf7e.msi
+ 2012-02-16 09:07 . 2012-02-16 09:07 5379072 c:\windows\Installer\24cf78.msi
+ 2012-02-16 09:07 . 2012-02-16 09:07 6041088 c:\windows\Installer\24cf6b.msi
- 2012-08-30 05:19 . 2012-06-27 06:00 11019776 c:\windows\SysWOW64\ieframe.dll
+ 2012-09-22 06:38 . 2012-08-24 17:08 11019776 c:\windows\SysWOW64\ieframe.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{70df8d13-bdd3-448e-944c-efde21b77161}"= "c:\program files (x86)\ClixSense.com\prxtbClix.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{70df8d13-bdd3-448e-944c-efde21b77161}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{1630669F-9D0C-4F0B-8AA9-10DE8BEE1755}]
2011-12-13 13:25 98816 ----a-w- c:\program files (x86)\MyBrowserCash\WTBPlugin.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{70df8d13-bdd3-448e-944c-efde21b77161}]
2011-05-09 09:49 176936 ----a-w- c:\program files (x86)\ClixSense.com\prxtbClix.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{70df8d13-bdd3-448e-944c-efde21b77161}"= "c:\program files (x86)\ClixSense.com\prxtbClix.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{70df8d13-bdd3-448e-944c-efde21b77161}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MyBrowserCash"="c:\program files (x86)\MyBrowserCash\MyBrowserCash.exe" [2012-09-08 104960]
"F.lux"="c:\users\Sony\Local Settings\Apps\F.lux\flux.exe" [2009-08-29 966656]
"googletalk"="c:\users\Sony\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-08-31 39408]
"Elbserver"="c:\program files (x86)\Sony\Media Gallery\ElbServer.exe" [2010-06-22 81264]
"VRLPHelper"="c:\program files (x86)\Sony\Media Gallery\VRLPHelper.exe" [2010-06-22 183152]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2010-06-01 673136]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-09 98304]
"PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2010-06-01 600928]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"SHTtray.exe"="c:\program files (x86)\Common Files\Sony Shared\SOHLib\SHTtray.exe" [2010-06-21 99696]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-6-9 1128224]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-31 136176]
R3 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-10-09 169312]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-29 250568]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [2010-06-23 342056]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2010-06-23 39464]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-31 136176]
R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [2010-05-28 158976]
R3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-06-24 271872]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-07 114144]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 98688]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2010-06-09 101232]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2008-06-16 55024]
S1 HssDRV6;Hotspot Shield Routing Driver 6;c:\windows\system32\DRIVERS\hssdrv6.sys [2012-08-01 41704]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-07-27 202752]
S2 hshld;Hotspot Shield Service;c:\program files (x86)\Hotspot Shield\bin\openvpnas.exe [2011-07-01 298824]
S2 HssWd;Hotspot Shield Monitoring Service;c:\program files (x86)\Hotspot Shield\bin\hsswd.exe [2011-05-25 329544]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-06-01 367456]
S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys [2010-06-23 94208]
S2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsne64.sys [2010-06-23 78848]
S2 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe [2010-05-25 252416]
S2 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2010-06-21 108400]
S2 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2010-06-18 423280]
S2 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2010-06-21 67952]
S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-I Visual Effects 2\uCamMonitor.exe [2008-09-18 104960]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-05-28 2320920]
S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2010-06-22 575856]
S2 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2010-06-17 851824]
S2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2010-06-09 537456]
S2 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2010-06-09 384880]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe [2010-06-09 836608]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [2009-05-26 19968]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-05-28 56344]
S3 Oliveusbser;Olive USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\Oliveusbser.sys [2011-01-26 124120]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [2010-04-26 12032]
S3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [2010-06-07 304496]
S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update Common\VUAgent.exe [2012-01-13 1256040]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2010-05-31 402720]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-26 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-29 15:52]
.
2012-09-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-31 06:11]
.
2012-09-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-31 06:11]
.
2012-09-26 c:\windows\Tasks\update-S-1-5-21-2509696765-2458900523-3203626048-1000.job
- c:\program files (x86)\Skillbrains\Updater\Updater.exe [2012-09-18 16:39]
.
2012-09-26 c:\windows\Tasks\update-sys.job
- c:\program files (x86)\Skillbrains\Updater\Updater.exe [2012-09-18 16:39]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2011-05-24 23:41 287048 ----a-w- c:\program files (x86)\Hotspot Shield\HssIE\HssIE_64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-05-31 10775584]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-05-31 2040352]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office12\EXCEL.EXE/3000
TCP: Interfaces\{8C40386B-A092-4F9D-9946-CDF395B0F66A}: NameServer = 8.8.8.8
TCP: Interfaces\{8D7741B6-5DFE-45D9-8382-3F260B2A29F8}: NameServer = 192.168.1.1
DPF: {0F2AAAE3-7E9E-4B64-AB5D-1CA24C6ACB9C} - hxxp://
www.simplexinfrastructures.net/dwa85W.cab
FF - ProfilePath - c:\users\Sony\AppData\Roaming\Mozilla\Firefox\Profiles\me74804f.default-1348162537959\
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{70DF8D13-BDD3-448E-944C-EFDE21B77161} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]
"ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=2000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\% C3 Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=inteldata\""
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10a.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10a.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-09-26 13:10:24
ComboFix-quarantined-files.txt 2012-09-26 07:40
ComboFix2.txt 2012-09-18 10:22
.
Pre-Run: 58,852,974,592 bytes free
Post-Run: 58,455,306,240 bytes free
.
- - End Of File - - 6BBAEE0439163689FFA3EC500C49D8C9