Archief - Verstuur spam

Download ComboFix van één van deze locaties:

Link 1
Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op.
>>Hier<< kunt u lezen hoe u Combofix dient te gebruiken.

1. Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix.

* (hier of hier staat een handleiding over hoe je deze kan uitschakelen

2. Het kan voorkomen dat de computer meerdere malen opnieuw gestart moet worden, dit is normaal.
3. Dubbelklik op "Combofix.exe" om de tool te starten.
4. Klik niet in het scherm van Combofix als deze actief is, hierdoor kan de 'tool' vastlopen.

* Noot !!! Als er een error wordt getoond met de melding "Illegal operation attempted on a registery key that has been marked for deletion." herstart dan de computer.

5. Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

ComboFix 11-05-11.01 - Cédric 12/05/2011 15:30:47.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.32.1033.18.2046.1094 [GMT 2:00]
Gestart vanuit: c:\users\Cédric\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
AV: Lavasoft Ad-Watch Live! Antivirus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
SP: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((( Bestanden Gemaakt van 2011-04-12 to 2011-05-12 ))))))))))))))))))))))))))))))
.
.
2011-05-12 13:35 . 2011-05-12 13:35 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-05-12 12:55 . 2011-05-12 12:56 -------- d-----w- c:\users\Cédric\AppData\Local\{E0577A89-5ABE-4B19-AB37-0632A549A70D}
2011-05-11 20:19 . 2011-05-11 20:19 388096 ----a-r- c:\users\Cédric\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-05-11 18:17 . 2011-05-11 18:17 -------- d-----w- c:\users\Cédric\AppData\Local\{F6ABF459-9B81-469C-8947-4E953694AF6B}
2011-05-10 10:19 . 2011-05-10 10:19 -------- d-----w- c:\users\Cédric\AppData\Local\{BD389B30-410B-4559-A1DE-3F4618C02140}
2011-05-09 12:13 . 2011-05-09 12:13 -------- d-----w- c:\users\Cédric\AppData\Local\{A9BF79E7-2041-49EC-8881-CDF4A519EF8A}
2011-05-08 21:07 . 2011-05-08 21:07 -------- d-----w- c:\users\Cédric\AppData\Local\{50758F96-E967-4D47-B81C-D67F00C95031}
2011-05-08 08:24 . 2011-05-08 08:24 -------- d-----w- c:\users\Cédric\AppData\Local\{4E3B5BCB-CE92-475F-9271-D73581564DEF}
2011-05-05 19:22 . 2011-05-05 19:22 -------- d-----w- c:\users\Cédric\AppData\Local\{DE473198-BF83-4D71-8D75-75C21B923F38}
2011-05-04 17:58 . 2011-05-04 17:59 -------- d-----w- c:\users\Cédric\AppData\Local\{314836E9-6A41-4261-85C0-AB37B50B98EA}
2011-05-03 16:50 . 2011-05-03 16:50 -------- d-----w- c:\users\Cédric\AppData\Local\{AC90C610-9015-4635-89CA-1ED7851A594E}
2011-05-03 11:39 . 2011-05-03 11:39 -------- d-----w- c:\users\Cédric\AppData\Local\{6930694A-C2CA-4EBD-A3E2-7566FC9A91B5}
2011-05-02 13:58 . 2011-05-02 13:58 -------- d-----w- c:\users\Cédric\AppData\Local\{7A8EAE95-5822-44C9-B570-F4F252A2CF22}
2011-05-01 10:00 . 2011-05-01 10:01 -------- d-----w- c:\users\Cédric\AppData\Local\{76DDDF19-C5C2-45D0-8014-2C05DBF4BE2C}
2011-04-30 22:42 . 2011-04-30 22:42 -------- d-----w- c:\users\Cédric\AppData\Local\{35A0FE01-795D-4650-BB6D-0A2BC2063EFF}
2011-04-30 09:47 . 2011-04-30 09:48 -------- d-----w- c:\users\Cédric\AppData\Local\{84BBF7C5-F800-4FCA-AF2A-F584C519F5FE}
2011-04-29 21:36 . 2011-02-26 06:23 2870272 ----a-w- c:\windows\explorer.exe
2011-04-29 21:36 . 2011-02-26 05:33 2614784 ----a-w- c:\windows\SysWow64\explorer.exe
2011-04-29 21:20 . 2011-04-29 21:20 -------- d-----w- c:\users\Cédric\AppData\Local\{FDE707D8-3520-4FCD-AE11-640E830EFC5A}
2011-04-26 09:43 . 2011-04-26 09:44 -------- d-----w- c:\users\Cédric\AppData\Local\{1D789E97-0FB7-44F7-BFAF-A6D6A2A1676A}
2011-04-25 20:20 . 2011-04-25 20:21 -------- d-----w- c:\users\Cédric\AppData\Local\{3FA75BDC-483D-443D-9A91-8B9C46C5A711}
2011-04-25 08:03 . 2011-04-25 08:04 -------- d-----w- c:\users\Cédric\AppData\Local\{6C41D44E-1380-48C8-A44C-9D119B16EDF8}
2011-04-24 12:15 . 2011-04-24 12:15 -------- d-----w- c:\users\Cédric\AppData\Local\{E2B70CD6-0875-41B0-A84A-333A390DFE59}
2011-04-23 08:02 . 2011-04-23 08:02 -------- d-----w- c:\users\Cédric\AppData\Local\{A2C05714-4D3C-451D-9BAD-FFAD0A2B5D42}
2011-04-22 09:03 . 2011-04-22 09:04 -------- d-----w- c:\users\Cédric\AppData\Local\{E9205C5F-B51F-4598-94A4-952B40A31E19}
2011-04-21 12:08 . 2011-04-21 12:08 -------- d-----w- c:\users\Cédric\AppData\Local\HP
2011-04-21 12:06 . 2010-06-14 14:24 361320 ------w- c:\windows\system32\HPDiscoPM9311.dll
2011-04-21 12:05 . 2011-04-21 12:05 -------- d-----w- c:\programdata\HP
2011-04-21 12:05 . 2011-04-21 12:05 -------- d-----w- c:\program files (x86)\HP
2011-04-21 12:04 . 2011-04-21 12:04 -------- d-----w- c:\program files\HP
2011-04-21 09:30 . 2011-04-21 09:30 -------- d-----w- c:\users\Cédric\AppData\Local\{E2B11F30-268E-4EEB-AB7D-E565320BCB51}
2011-04-20 11:48 . 2011-04-20 11:48 -------- d-----w- c:\users\Cédric\AppData\Local\{4E91080A-D372-4EE9-8BA6-112DFF0BF342}
2011-04-19 10:11 . 2011-04-19 10:12 -------- d-----w- c:\users\Cédric\AppData\Local\{32F6009F-BD89-4193-9CE7-49CCC8AF00BC}
2011-04-18 11:45 . 2011-04-18 11:46 -------- d-----w- c:\users\Cédric\AppData\Local\{0E9D7936-4288-4324-A081-7CF1BD5B149C}
2011-04-17 12:45 . 2011-04-17 12:45 -------- d-----w- c:\users\Cédric\AppData\Local\{BC26514C-F7B6-4992-AB72-B72EDB50CB8A}
2011-04-16 17:20 . 2011-04-16 17:20 -------- d-----w- c:\users\Cédric\AppData\Local\{DA3C4957-DCC0-4289-9612-4D6F03EE6F56}
2011-04-15 15:23 . 2011-02-05 12:41 640896 ----a-w- c:\windows\system32\winload.efi
2011-04-15 15:21 . 2011-04-15 15:21 -------- d-----w- c:\users\Cédric\AppData\Local\{38BDA2D7-6779-4FFF-8BB8-8BE381AA19D7}
2011-04-14 14:12 . 2011-04-14 14:12 -------- d-----w- c:\users\Cédric\AppData\Local\{FB6D23A0-E635-448C-A0AF-7E9692A26304}
2011-04-14 01:39 . 2011-04-14 01:39 103864 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\nppdf32.dll
2011-04-14 01:39 . 2011-04-14 01:39 103864 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll
2011-04-13 10:44 . 2011-04-13 10:44 -------- d-----w- c:\users\Cédric\AppData\Local\{359722E0-7359-4BB4-8ABC-1962DB9AE7CF}
.
.
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-11 20:19 . 2011-05-11 20:19 388096 ----a-r- c:\users\Cédric\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-05-11 20:19 . 2011-05-11 20:19 388096 ----a-r- c:\users\Cédric\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-04-07 07:59 . 2011-01-06 20:43 16432 ----a-w- c:\windows\system32\lsdelete.exe
2011-03-09 22:22 . 2010-06-24 10:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-03-04 06:17 . 2011-04-29 21:35 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2011-03-04 06:17 . 2011-04-29 21:35 347648 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2011-02-19 06:37 . 2011-03-09 22:26 1135104 ----a-w- c:\windows\system32\FntCache.dll
2011-02-19 06:37 . 2011-03-09 22:26 1540608 ----a-w- c:\windows\system32\DWrite.dll
2011-02-19 06:36 . 2011-03-09 22:26 902656 ----a-w- c:\windows\system32\d2d1.dll
2011-02-19 05:32 . 2011-03-09 22:26 1074176 ----a-w- c:\windows\SysWow64\DWrite.dll
2011-02-19 05:32 . 2011-03-09 22:26 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AutoStartNPSAgent"="c:\program files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe" [2010-07-04 95576]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-08-10 421888]
"Adobe Reader Speed Launcher"="d:\programma's\Adobe Reader\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"GrooveMonitor"="d:\programma's\Office 2007\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http:" [X]
.
c:\users\C&#8218;dric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Schermopname en Snel starten.lnk - d:\programma's\Office 2007\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-05-02 2146496]
R3 ATICDSDr;ATICDSDr;c:\users\CDRIC~1\AppData\Local\Temp\ATICDSDr.sys [x]
R3 RivaTuner64;RivaTuner64;d:\programma's\RivaTuner\RivaTuner64.sys [2009-12-30 19952]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [x]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [x]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [x]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [2010-06-14 16448]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S2 SBSDWSCService;SBSD Security Center Service;d:\programma's\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S4 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [x]
S4 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [x]
S4 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [x]
S4 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [x]
S4 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [x]
.
.
--- Andere Services/Drivers In Geheugen ---
.
*Deregistered* - Avgldx64
*Deregistered* - Lavasoft Kernexplorer
.
Inhoud van de 'Gedeelde Taken' map
.
2011-04-21 c:\windows\Tasks\hpwebreg_CN09I2928205HX.job
- c:\program files\HP\HP Deskjet 3050 J610 series\Bin\hpwebreg.exe [2010-06-14 14:29]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-12-10 9643552]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
.
------- Bijkomende Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://google.be/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = 10.1.66.12:8080
IE: E&xporteren naar Microsoft Excel - d:\progra~1\OFFICE~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Cédric\AppData\Roaming\Mozilla\Firefox\Profiles\js36gbgx.default\
FF - prefs.js: network.proxy.type - 4
.
- - - - ORPHANS VERWIJDERD - - - -
.
Wow6432Node-HKLM-Run-NPSStartup - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
.
.
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Voltooingstijd: 2011-05-12 15:39:12
ComboFix-quarantined-files.txt 2011-05-12 13:39
.
Pre-Run: 7.537.868.800 bytes free
Post-Run: 7.934.160.896 bytes free
.
- - End Of File - - 6F758AD1A3FFFB674D5D91D548468DDC