ComboFix 10-08-30.02 - Administrator /08/31 ๆๆไบ 20:24:34.4.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.[removed].18.511.291 [GMT 8:00]
ๅท่กไฝ็ฝฎ: c:\documents and settings\Administrator\ๆก้ข\ComboFix.exe
AV: Norton AntiVirus 2005 *On-access scanning disabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.
((((((((((((((((((((((((((((((((((((((( ่ขซๅช้ค็ๆชๆก )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Thumbs.db
c:\windows\daemon.dll
c:\windows\system32\UACmpqjadwjfj.db
.
((((((((((((((((((((((((( 2010-07-28 ่ณ 2010-08-31 ็ๆฐ็ๆชๆก )))))))))))))))))))))))))))))))
.
2010-08-22 07:14 . 2010-08-22 07:15 โโโ dโโw- c:\program files\eMule
2010-08-21 02:25 . 1997-11-06 06:53 27648 โ-a-w- c:\windows\system32\ir50_lcs.dll
2010-08-20 14:24 . 2010-08-20 14:24 โโโ dโโw- C:\FOUND.001
2010-08-20 14:06 . 2010-04-29 07:39 38224 โ-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-20 13:53 . 2010-04-29 07:39 20952 โ-a-w- c:\windows\system32\drivers\mbam.sys
2010-08-20 13:28 . 2010-08-20 13:28 โโโ dโโw- c:\program files\Malwarebytes' Anti-Malware
2010-08-14 11:08 . 2010-08-14 11:08 โโโ dโโw- c:\program files\MagicDisc
.
(((((((((((((((((((((((((((((((((((((((( ๅจไธๅๆๅ
ง่ขซไฟฎๆน็ๆชๆก ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-24 02:38 . 2010-07-24 02:37 144696 โ-a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.exe
2010-07-24 02:23 . 2010-07-24 02:08 57344 โ-a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-07-24 02:20 . 2010-07-24 02:20 โโโ dโโw- c:\program files\DivX
2010-07-24 02:00 . 2010-07-24 02:00 โโโ dโโw- c:\documents and settings\Administrator\Application Data\DivX
2010-07-24 01:50 . 2010-07-24 01:50 โโโ dโโw- c:\documents and settings\All Users\Application Data\DivX
2010-07-06 19:35 . 2010-07-06 19:35 2396 โ-a-w- c:\windows\system32\PerfStringBackup.TMP
2010-07-06 19:35 . 2001-09-17 04:00 68308 โ-a-w- c:\windows\system32\prfc0404.dat
2010-07-06 19:35 . 2001-09-17 04:00 222718 โ-a-w- c:\windows\system32\prfh0404.dat
2005-07-06 17:25 . 2005-07-06 17:25 56 โshโr- c:\windows\system32\D782B1A6B6.sys
.
โโ- Sigcheck โโ-
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[-] 2008-06-20 . 01D5EAAFF224415A7FF513E4C882BE30 . 360320 . . [5.1.2600.3394] . . c:\windows\system32\drivers\tcpip.sys
[7] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\system32\dllcache\tcpip.sys
[7] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\5a805edbaa54f0da2a0bf62909893538\tcpip.sys
[7] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
[7] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[7] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[7] 2006-04-20 . 1DBF125862891817F374F407626967F4 . 359808 . . [5.1.2600.2892] . . c:\windows\$NtUninstallKB941644$\tcpip.sys
[7] 2006-01-13 . 5562CC0A47B2AEF06D3417B733F3C195 . 360448 . . [5.1.2600.2827] . . c:\windows\$hf_mig$\KB913446\SP2QFE\tcpip.sys
[7] 2006-01-13 . 583E063FDC888CA30D05C2724B0D7EF4 . 359808 . . [5.1.2600.2827] . . c:\windows\$NtUninstallKB917953$\tcpip.sys
[7] 2005-05-25 . 63FDFEA54EB53DE2D863EE454937CE1E . 359936 . . [5.1.2600.2685] . . c:\windows\$hf_mig$\KB893066\SP2QFE\tcpip.sys
[7] 2005-05-25 . 88763A98A4C26C409741B4AA162720C9 . 359808 . . [5.1.2600.2685] . . c:\windows\$NtUninstallKB913446$\tcpip.sys
[7] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB893066$\tcpip.sys
[7] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2001-09-17 . E7774698BB0D14B0710A9A31E209F9B6 . 327168 . . [5.1.2600.0] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
[-] 2008-04-15 . F1A48452D018059538CD66E76261C2F4 . 247296 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\5a805edbaa54f0da2a0bf62909893538\tapisrv.dll
[-] 2007-06-18 . E1E074DB9C0C158736A04EC9B6144B3F . 246784 . . [5.1.2600.3158] . . c:\windows\$hf_mig$\KB938828\SP2QFE\tapisrv.dll
[-] 2007-06-18 . 0C78C3605A7830262AAEEE153D2CC913 . 246784 . . [5.1.2600.3158] . . c:\windows\system32\tapisrv.dll
[-] 2007-06-18 . 0C78C3605A7830262AAEEE153D2CC913 . 246784 . . [5.1.2600.3158] . . c:\windows\system32\dllcache\tapisrv.dll
[7] 2005-07-08 . 5BAB8AB739453DD356A5C137F48159F1 . 246784 . . [5.1.2600.2716] . . c:\windows\$hf_mig$\KB893756\SP2QFE\tapisrv.dll
[7] 2005-07-08 . FCF84F606E86557FD0FCD2CE21F4D245 . 246784 . . [5.1.2600.2716] . . c:\windows\$NtUninstallKB938828$\tapisrv.dll
[7] 2004-08-12 . B33207375E2B018409286E9477A1B517 . 243712 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\tapisrv.dll
[7] 2004-08-12 . B33207375E2B018409286E9477A1B517 . 243712 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB893756$\tapisrv.dll
[-] 2001-09-17 . CE5CECC3EEBCEE1CE39928F9718095C7 . 233984 . . [5.1.2600.0] . . c:\windows\$NtServicePackUninstall$\tapisrv.dll
[-] 2008-04-15 . 88057E7B74236C11098E4D4EEAC7DF5E . 978432 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\5a805edbaa54f0da2a0bf62909893538\explorer.exe
[-] 2007-06-18 . D1822278F43E2850E03EF36D29686D4F . 977920 . . [6.00.2900.3158] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2007-06-18 . 3DDB98936B29019549C6FBABD86846E7 . 977920 . . [6.00.2900.3158] . . c:\windows\explorer.exe
[-] 2007-06-18 . 3DDB98936B29019549C6FBABD86846E7 . 977920 . . [6.00.2900.3158] . . c:\windows\system32\dllcache\explorer.exe
[7] 2004-08-12 . 211358AE74733075C22142B3AC519A19 . 976896 . . [6.00.2900.2180] . . c:\windows\ServicePackFiles\i386\explorer.exe
[7] 2004-08-12 . 211358AE74733075C22142B3AC519A19 . 976896 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe
[-] 2001-09-17 . EE2156A747C0038FA3453DE33F081878 . 1000960 . . [6.00.2600.0000] . . c:\windows\$NtServicePackUninstall$\explorer.exe
.
((((((((((((((((((((((((((((((((((((( ้่ฆ็ปๅ
ฅ้ป ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*ๆณจๆ* ็ฉบ็ฝ่ๅๆณ็ผบ็็ป้ๅฐไธๆ่ขซ้กฏ็คบ
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RealPlayer"="c:\program files\Real\RealOne Player\realplay.exe" [2006-06-06 1003520]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="NvQTwk" [X]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\System32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-12 455168]
"PHIME2002A"="c:\windows\System32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-12 455168]
"00THotkey"="c:\windows\System32\00THotkey.exe" [2002-01-08 245760]
"000StTHK"="000StTHK.exe" [2001-06-23 24576]
"Tpwrtray"="TPWRTRAY.EXE" [2002-01-25 196608]
"TFncKy"="TFncKy.exe" [BU]
"SxgTkBar"="SxgTkBar.exe" [2001-07-11 53248]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2001-08-16 94208]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2001-08-16 376832]
"TosHKCW.exe"="c:\program files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2002-01-22 49152]
"TFNF5"="TFNF5.exe" [2001-08-03 73728]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2002-10-17 151597]
"LWBMOUSE"="c:\program files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe" [2001-03-26 429568]
"gcasServ"="c:\program files\Microsoft AntiSpyware\gcasServ.exe" [2005-11-15 473928]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-05-19 59040]
"Symantec NetDriver Monitor"="c:\progra~1\SYMNET~1\SNDMon.exe" [2006-01-12 100056]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-26 148888]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\System32\ctfmon.exe" [2004-08-12 15360]
c:\documents and settings\Administrator\ใ้ๅงใๅ่ฝ่กจ\็จๅผ้\ๅๅ\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2010-8-14 576000]
c:\documents and settings\All Users\ใ้ๅงใๅ่ฝ่กจ\็จๅผ้\ๅๅ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield 1942\\bf1942.exe"=
"c:\\Program Files\\Messenger\\MSMSGS.EXE"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\System32\\dpvsetup.exe"=
"c:\\Documents and Settings\\Administrator\\ๆก้ข\\้ญ?1.07\\Warcraft III.exe"=
"g:\\CQ Design Institute\\GEO\\้ญ?1.07\\Warcraft III.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\NextLink\\GOGOBOX\\gfscagent.exe"=
"c:\\Program Files\\NextLink\\GOGOBOX\\gogobox.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\WINDOWS\\System32\\dplaysvr.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [2005/7/1 ไธๅ 12:55 155136]
R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [2005/7/1 ไธๅ 12:55 5248]
R0 pciSm;pciSm;c:\windows\system32\drivers\tossmpci.sys [2002/7/31 ไธๅ 11:47 45803]
R0 TVALDX;Toshiba ACPI-Based Value Added Logical Device Extension Driver;c:\windows\system32\drivers\TVALDX.SYS [2002/7/31 ไธๅ 11:43 6082]
R2 ่ชๅ LiveUpdate ๆ็จๅจ;่ชๅ LiveUpdate ๆ็จๅจ;c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe [2006/12/29 ไธๅ 11:13 100032]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010/8/20 ไธๅ 10:06 38224]
R3 SOFTXG;YAMAHA XG WDM SoftSynthesizer;c:\windows\system32\drivers\sxgxgwdm.sys [2002/7/31 ไธๅ 11:51 966784]
โ Other Services/Drivers In Memory โ
*NewlyCreated* - MBAMSWISSARMY
.
โ่จๅไปปๅโ ๆไปถๅคพ ่ฃก็ๅ
งๅฎน
2010-08-27 c:\windows\Tasks\Norton AntiVirus - ๆๆๆ็้ป่
ฆ - Administrator.job
- c:\progra~1\NORTON~1\Navw32.exe [2004-09-01 10:36]
2010-08-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 04:34]
.
.
โโ- ่ๅค็ๆๆ โโ-
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
IE: ๅฏๅบ่ณ Microsoft Excel(&X) - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: {9B69C40C-4719-4BCA-85F7-49A8AFC67880} = 218.102.32.208 205.252.144.126
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\uhgh87ld.Default User\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/accounts/ServiceLogin?service=mail&passive=true&rm=false&continue=https%3A%2F%2Fmail.google.com%2Fmail%2F%3Fnsr%3D1%26ui%3Dhtml%26zy%3Dl
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
โ- ็ซ็้
็ฝฎๆไปถ โ-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xnโmgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xnโmgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
.
โโ- ๆไปถ้กๅ โโ-
.
.scr=AutoCADScript
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2010-08-31 20:31
Windows 5.1.2600 Service Pack 2 FAT NTAPI
ๆๆ่ขซ้ฑ่็้ฒ็จ โฆ
ๆๆ่ขซ้ฑ่็ๅๅ็ต โฆ
ๆๆ่ขซ้ฑ่็ๆไปถ โฆ
ๆๆๅฎๆ
่ขซ้ฑ่็ๆชๆก: 0
**************************************************************************
Binary file temp00 matches
.
โโโโโโโ LOCKED REGISTRY KEYS โโโโโโโ
[HKEY_USERS\.Default\AppEvents\Schemes\Apps\Conf\ๆธๅฟ*๎ฃQ\.Current]
@="c:\\Program Files\\NetMeeting\\Blip.wav"
[HKEY_USERS\LocalService\AppEvents\Schemes\Apps\Conf\ๆธๅฟ*๎ฃQ\.Current]
@="c:\\Program Files\\NetMeeting\\Blip.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Conf\ๆธๅฟ*๎ฃQ\.Current]
@="c:\\Program Files\\NetMeeting\\Blip.wav"
[HKEY_USERS\S-1-5-21-1605616401-71594873-1131426265-500\AppEvents\Schemes\Apps\Conf\ๆธๅฟ*๎ฃQ\.Current]
@="c:\\Program Files\\NetMeeting\\Blip.wav"
[HKEY_USERS\S-1-5-21-1605616401-71594873-1131426265-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\ N_*8n_*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"Order"=hex:08,00,00,00,02,00,00,00,da,01,00,00,01,00,00,00,04,00,00,00,74,00,
00,00,00,00,00,00,66,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,54,00,32,\
[HKEY_USERS\S-1-5-21-1605616401-71594873-1131426265-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\wc๎ *-* * *D๎ ฅ\ๆฐ(u z_]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_USERS\S-1-5-21-1605616401-71594873-1131426265-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\nndto@Y,n3*"{E`3U]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"Order"=hex:08,00,00,00,02,00,00,00,14,01,00,00,01,00,00,00,02,00,00,00,86,00,
00,00,00,00,00,00,78,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,66,00,36,\
[HKEY_USERS\S-1-5-21-1605616401-71594873-1131426265-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\้จRโฌl๎กฉ_5*๎ธ๏ก^tX]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
[HKEY_USERS\S-1-5-21-1605616401-71594873-1131426265-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\At|๎?\3*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
[HKEY_USERS\S-1-5-21-299502267-1606980848-854245398-500_Classes\O*v*e*r*t*u*r*e* *j\๏ท
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_USERS\S-1-5-21-299502267-1606980848-854245398-500_Classes\O*v*e*r*t*u*r*e* *j\๏ถDefaultIcon]
@=expand:"%APPDATA%\\Microsoft\\Installer\\{50ADDF79-3249-4679-B527-3FB8C5EA99E5}\\_294823.exe,0"
[HKEY_USERS\S-1-5-21-299502267-1606980848-854245398-500_Classes\O*v*e*r*t*u*r*e* *j\๏ถshell]
@="open"
[HKEY_USERS\S-1-5-21-299502267-1606980848-854245398-500_Classes\O*v*e*r*t*u*r*e* *j\๏ถshell\open]
@="้ๅ(&O)"
[HKEY_USERS\S-1-5-21-299502267-1606980848-854245398-500_Classes\O*v*e*r*t*u*r*e* *j\๏ถshell\open\command]
@="\"c:\\Program Files\\Overture 4.0 ็น้ซไธญๆ็\\Overture.exe\" \"%1\""
"command"=multi:"%_(xAdi9`=RGK6dXKNlr>?%)duR)D9Xu~OSIW`PT- \"%1\"\00\00"
[HKEY_LOCAL_MACHINE\software\Classes\B*D*A*T*u*n*e*r*.*CQ่ญธ\CLSID]
@="{809B6661-94C4-49E6-B6EC-3F0F862215AA}"
[HKEY_LOCAL_MACHINE\software\Classes\B*D*A*T*u*n*e*r*.*CQ่ญธ\CurVer]
@="BDATuner.ๅ
ไปถ.1"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\้จRโฌl๎กฉ_5*๎ธ๏ก^tX]
"SlowInfoCache"=hex:28,02,00,00,01,00,00,00,ff,ff,ff,ff,ff,ff,ff,ff,00,40,10,
3f,a7,97,c6,01,18,00,00,00,43,00,3a,00,5c,00,47,00,54,00,41,00,20,00,56,00,\
"Changed"=dword:00000000
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Print\Printers\?ๆ A N Y O N E - 3 D C F 4 6 2 0
N๏
H P D e s k J e t 9 3 0 C / 9 3 2 C / 9 3 5 C \DsDriver]
"printBinNames"=multi:"่ชๅ้ธๅ\00ไธๆน็ดๅฃ\00ๆๅ้็ด\00ไฟกๅฐ, ๆๅ้็ด\00\00"
"printCollate"=hex:01
"printColor"=hex:01
"printDuplexSupported"=hex:00
"printStaplingSupported"=hex:00
"printMaxXExtent"=dword:0000086f
"printMaxYExtent"=dword:00000de4
"printMinXExtent"=dword:000003e8
"printMinYExtent"=dword:000005b4
"printMediaSupported"=multi:"Letter\00Legal\00Executive\00A4\00A5\00B5 (JIS)\00Envelope #10\00Envelope DL\00Envelope C6\00Japanese Postcard\00A6\00Envelope A2\00US Index Card 4x6\00US Index Card 5x8\00\00"
"printMediaReady"=multi:"A4\00\00"
"printNumberUp"=dword:00000006
"printOrientationsSupported"=multi:"PORTRAIT\00LANDSCAPE\00\00"
"printMaxResolutionSupported"=dword:000004b0
"printLanguage"=multi:"PCL\00\00"
"printRate"=dword:00000009
"printRateUnit"="PagesPerMinute"
"printPagesPerMinute"=dword:00000009
"driverVersion"=dword:00000401
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Print\Printers\?ๆ A N Y O N E - 3 D C F 4 6 2 0
N๏
H P D e s k J e t 9 3 0 C / 9 3 2 C / 9 3 5 C \DsSpooler]
"description"=""
"driverName"="HP DeskJet 930C/932C/935C"
"location"=""
"portName"=multi:"\\\\ANYONE-3DCF4620\\ๆๅฐๆบ\00\00"
"printStartTime"=dword:00000000
"printEndTime"=dword:00000000
"printerName"="่ชๅ ANYONE-3DCF4620 ไธ็ HP DeskJet 930C/932C/935C"
"printKeepPrintedJobs"=hex:00
"printSeparatorFile"=""
"printShareName"=""
"printSpooling"="PrintWhileSpooling"
"priority"=dword:00000001
"uNCName"="\\\\LEE-YV2R7VX5FBM\\่ชๅ ANYONE-3DCF4620 ไธ็ HP DeskJet 930C/932C/935C"
"versionNumber"=dword:00000004
"serverName"="LEE-YV2R7VX5FBM"
"shortServerName"="LEE-YV2R7VX5FBM"
"flags"=dword:00000000
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Print\Printers\?ๆ A N Y O N E - 3 D C F 4 6 2 0
N๏
H P D e s k J e t 9 3 0 C / 9 3 2 C / 9 3 5 C \PrinterDriverData]
"InitDriverVersion"=dword:00000500
"Model"="HP DeskJet 930C/932C/935C"
"PrinterDataSize"=dword:00000230
"PrinterData"=hex:00,05,30,02,81,08,00,00,80,1a,06,00,00,00,00,00,00,00,00,00,
64,00,58,02,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,f4,0c,86,d1,01,\
"FeatureKeywordSize"=dword:0000001d
"FeatureKeyword"=hex:48,50,44,75,70,6c,65,78,55,6e,69,74,00,4e,6f,74,49,6e,73,
74,61,6c,6c,65,64,00,0a,00,00
"Forms?"=dword:d1860cf4
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\?ๆ *L*i*v*e*U*p*d*a*t*e* *๎จ zhV\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
.
ๅฎๆๆ้: 2010-08-31 20:34:16
ComboFix-quarantined-files.txt 2010-08-31 12:34
Pre-Run: 361,971,712 ไฝๅ
็ตๅฏ็จ
Post-Run: 330,448,896 ไฝๅ
็ตๅฏ็จ
Current=2 Default=2 Failed=3 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 02D46F5EDBC7E282BE867C20202064F1
nth strange in computerโฆbut need to cut connection and reconnect to internet to load this page
