RallyReal
2009-04-06, 07:09
ComboFix 09-04-01.01 - Owner 2009-04-05 20:47:34.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.126 [GMT -7:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090405-1] *On-access scanning enabled* (Updated)
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2009-03-06 to 2009-04-06 )))))))))))))))))))))))))))))))
.
2009-04-05 20:45 . 2009-04-05 20:45 <DIR> d-------- C:\32788R22FWJFW
2009-04-05 20:45 . 2006-03-03 00:42 73,728 --a------ C:\pv.exe
2009-03-28 13:50 . 2009-03-28 13:50 2,560 --a------ c:\winnt\_MSRSTRT.EXE
2009-03-27 08:35 . 2009-03-28 13:50 <DIR> d-------- c:\program files\Common Files\Agnitum Shared
2009-03-27 08:35 . 2009-03-27 08:35 <DIR> d-------- c:\program files\Agnitum
2009-03-27 08:18 . 2009-03-27 08:18 <DIR> d-------- c:\program files\Alwil Software
2009-03-26 17:48 . 2009-03-26 17:48 <DIR> d-------- c:\program files\iPod
2009-03-26 17:46 . 2009-03-26 17:49 <DIR> d-------- c:\program files\iTunes
2009-03-26 17:46 . 2009-03-26 17:49 <DIR> d-------- c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-26 17:44 . 2009-03-26 17:44 <DIR> d-------- c:\program files\Bonjour
2009-03-26 17:42 . 2009-03-26 17:43 <DIR> d-------- c:\program files\QuickTime
2009-03-26 11:52 . 1999-12-21 07:58 21,312 --a------ c:\winnt\choice.exe
2009-03-26 11:49 . 2009-03-26 11:49 <DIR> d-------- C:\ie-spyad
2009-03-25 16:31 . 2009-03-25 16:32 <DIR> d-------- c:\documents and settings\Owner\.SunDownloadManager
2009-03-24 19:47 . 2009-03-24 19:47 <DIR> d--hs---- c:\documents and settings\LocalService\IETldCache
2009-03-24 19:39 . 2009-03-24 19:39 <DIR> d--hs---- c:\documents and settings\Owner\IECompatCache
2009-03-23 19:11 . 2009-03-23 19:11 <DIR> d--hs---- c:\documents and settings\Owner\PrivacIE
2009-03-23 19:10 . 2009-03-23 19:10 <DIR> d--hs---- c:\documents and settings\Owner\IETldCache
2009-03-23 18:54 . 2009-03-23 18:58 <DIR> d--h----- c:\winnt\msdownld.tmp
2009-03-23 18:54 . 2009-03-23 18:57 <DIR> d--h-c--- c:\winnt\ie8
2009-03-21 20:10 . 2009-03-21 20:10 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-03-21 20:10 . 2009-03-21 20:10 <DIR> d-------- c:\documents and settings\Owner\Application Data\Malwarebytes
2009-03-21 20:10 . 2009-03-21 20:10 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-03-21 20:10 . 2009-02-11 10:19 38,496 --a------ c:\winnt\system32\drivers\mbamswissarmy.sys
2009-03-21 20:10 . 2009-02-11 10:19 15,504 --a------ c:\winnt\system32\drivers\mbam.sys
2009-03-20 13:37 . 2009-03-20 13:37 <DIR> d-------- c:\program files\ERUNT
2009-03-20 01:00 . 2009-03-20 01:00 206 --a------ c:\winnt\system32\MRT.INI
2009-03-19 23:45 . 2009-03-20 00:52 2 --a------ C:\278134064
2009-03-15 17:02 . 2009-03-15 17:21 <DIR> d-------- c:\program files\Only Astrology
2009-03-08 14:22 . 2009-03-08 14:22 49,152 --------- c:\winnt\system32\msrating.dll.mui
2009-03-08 14:22 . 2009-03-08 14:22 2,560 --------- c:\winnt\system32\mshta.exe.mui
2009-03-08 14:21 . 2009-03-08 14:21 4,096 --------- c:\winnt\system32\ie4uinit.exe.mui
2009-03-08 14:20 . 2009-03-08 14:20 81,920 --------- c:\winnt\system32\iedkcs32.dll.mui
2009-03-08 04:33 . 2009-03-08 04:33 18,944 --------- c:\winnt\system32\dllcache\corpol.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-02 01:53 --------- d-----w c:\program files\GetRight
2009-03-28 00:18 --------- d-----w c:\program files\Virtual Villagers - The Lost Children
2009-03-27 00:48 --------- d-----w c:\program files\Common Files\Apple
2009-03-25 23:35 410,984 ----a-w c:\winnt\system32\deploytk.dll
2009-03-25 23:35 --------- d-----w c:\program files\Java
2009-03-24 02:11 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-03-24 01:58 --------- d-----w c:\program files\Yahoo!
2009-03-24 01:58 --------- d-----w c:\documents and settings\All Users\Application Data\yahoo!
2009-03-20 07:52 14,336 ----a-w c:\winnt\system32\svchost.exe
2009-03-20 07:52 14,336 ----a-w c:\winnt\system32\dllcache\svchost.exe
2009-03-16 00:08 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-03-08 21:09 638,816 ----a-w c:\winnt\system32\dllcache\iexplore.exe
2009-03-08 21:09 391,536 ----a-w c:\winnt\system32\dllcache\iedkcs32.dll
2009-03-08 11:41 5,937,152 ----a-w c:\winnt\system32\dllcache\mshtml.dll
2009-03-08 11:39 11,063,808 ----a-w c:\winnt\system32\dllcache\ieframe.dll
2009-03-08 11:34 914,944 ----a-w c:\winnt\system32\wininet.dll
2009-03-08 11:34 914,944 ----a-w c:\winnt\system32\dllcache\wininet.dll
2009-03-08 11:34 43,008 ----a-w c:\winnt\system32\licmgr10.dll
2009-03-08 11:34 43,008 ----a-w c:\winnt\system32\dllcache\licmgr10.dll
2009-03-08 11:34 236,544 ----a-w c:\winnt\system32\dllcache\webcheck.dll
2009-03-08 11:34 193,536 ----a-w c:\winnt\system32\dllcache\msrating.dll
2009-03-08 11:34 109,568 ----a-w c:\winnt\system32\dllcache\occache.dll
2009-03-08 11:34 105,984 ----a-w c:\winnt\system32\dllcache\url.dll
2009-03-08 11:34 1,206,784 ----a-w c:\winnt\system32\dllcache\urlmon.dll
2009-03-08 11:33 759,296 ----a-w c:\winnt\system32\dllcache\VGX.dll
2009-03-08 11:33 726,528 ----a-w c:\winnt\system32\dllcache\jscript.dll
2009-03-08 11:33 420,352 ----a-w c:\winnt\system32\vbscript.dll
2009-03-08 11:33 420,352 ----a-w c:\winnt\system32\dllcache\vbscript.dll
2009-03-08 11:33 25,600 ----a-w c:\winnt\system32\dllcache\jsproxy.dll
2009-03-08 11:33 229,376 ----a-w c:\winnt\system32\dllcache\ieaksie.dll
2009-03-08 11:33 18,944 ----a-w c:\winnt\system32\corpol.dll
2009-03-08 11:33 125,952 ----a-w c:\winnt\system32\dllcache\ieakeng.dll
2009-03-08 11:32 94,720 ----a-w c:\winnt\system32\dllcache\inseng.dll
2009-03-08 11:32 72,704 ----a-w c:\winnt\system32\dllcache\admparse.dll
2009-03-08 11:32 72,704 ----a-w c:\winnt\system32\admparse.dll
2009-03-08 11:32 71,680 ----a-w c:\winnt\system32\iesetup.dll
2009-03-08 11:32 71,680 ----a-w c:\winnt\system32\dllcache\iesetup.dll
2009-03-08 11:32 611,840 ----a-w c:\winnt\system32\dllcache\mstime.dll
2009-03-08 11:32 594,432 ----a-w c:\winnt\system32\dllcache\msfeeds.dll
2009-03-08 11:32 55,808 ----a-w c:\winnt\system32\dllcache\iernonce.dll
2009-03-08 11:32 173,056 ----a-w c:\winnt\system32\dllcache\ie4uinit.exe
2009-03-08 11:32 163,840 ----a-w c:\winnt\system32\dllcache\ieakui.dll
2009-03-08 11:32 128,512 ----a-w c:\winnt\system32\dllcache\advpack.dll
2009-03-08 11:32 1,985,024 ----a-w c:\winnt\system32\dllcache\iertutil.dll
2009-03-08 11:24 68,608 ----a-w c:\winnt\system32\dllcache\hmmapi.dll
2009-03-08 11:22 156,160 ----a-w c:\winnt\system32\msls31.dll
2009-03-08 11:22 156,160 ----a-w c:\winnt\system32\dllcache\msls31.dll
2009-03-08 11:11 445,952 ----a-w c:\winnt\system32\dllcache\ieapfltr.dll
2009-02-25 23:19 --------- d-----w c:\documents and settings\Owner\Application Data\vlc
2009-02-25 22:57 --------- d-----w c:\program files\VideoLAN
2009-02-21 07:36 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-19 05:06 --------- d-----w c:\program files\Common Files\Adobe AIR
2009-02-19 05:04 --------- d-----w c:\documents and settings\Owner\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-02-09 11:13 1,846,784 ----a-w c:\winnt\system32\win32k.sys
2009-02-09 11:13 1,846,784 ------w c:\winnt\system32\dllcache\win32k.sys
2009-01-08 01:21 26,144 ----a-w c:\winnt\system32\spupdsvc.exe
2009-01-08 01:20 474,112 ------w c:\winnt\system32\dllcache\shlwapi.dll
2009-01-08 01:20 265,720 ----a-w c:\winnt\system32\msdbg2.dll
2009-01-08 01:20 26,112 ----a-w c:\winnt\system32\idndl.dll
2009-01-08 01:20 24,576 ----a-w c:\winnt\system32\nlsdl.dll
2009-01-08 01:20 23,552 ----a-w c:\winnt\system32\normaliz.dll
2009-01-08 01:20 134,144 ------w c:\winnt\system32\dllcache\sqmapi.dll
2009-01-08 01:20 1,497,088 ------w c:\winnt\system32\dllcache\shdocvw.dll
2009-01-08 01:20 1,022,976 ------w c:\winnt\system32\dllcache\browseui.dll
2008-04-13 10:17 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2005-06-03 17:18 26,166,613 ----a-w c:\program files\NAV05ENG.exe
2005-05-30 23:51 315,624 ----a-w c:\program files\dxwebsetup.exe
2005-02-18 07:35 626,884 ----a-w c:\program files\kukuxumusu_2.zip
2005-02-16 07:02 68,257 ----a-w c:\program files\metallix.zip
2004-11-07 09:45 2,663,024 ----a-w c:\program files\lusetup.exe
2004-08-17 19:45 295,120 ----a-w c:\program files\NSSetup.exe
2004-08-07 23:13 420,974 ----a-w c:\program files\XviD-04102002-1.exe
2004-08-07 23:12 325,354 ----a-w c:\program files\ffdshow-20020617.exe
2004-08-06 02:04 273,342 ----a-w c:\program files\DivFix110.zip
2004-03-24 09:24 401,952 ----a-w c:\program files\3DwindowsXP.exe
2004-02-22 01:18 410,644 ----a-w c:\program files\KTAngelSaver.zip
2004-01-31 02:31 795,540 ----a-w c:\program files\fishtank.zip
2004-01-25 04:39 1,678,680 ----a-w c:\program files\monalisa.exe
2004-01-25 04:37 942,790 ----a-w c:\program files\hypno.zip
2004-01-25 04:37 56,785 ----a-w c:\program files\electric.zip
2004-01-25 04:36 103,708 ----a-w c:\program files\julsav10.zip
2004-01-25 04:35 272,666 ----a-w c:\program files\blaze.zip
2004-01-25 04:34 1,098,212 ----a-w c:\program files\living_waterfall_es.exe
2008-09-28 17:40 32,768 --sha-w c:\winnt\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008092820080929\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\winnt\system32\ctfmon.exe" [2008-04-13 15360]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-25 148888]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-12 342312]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-13 c:\winnt\system32\narrator.exe]
c:\documents and settings\Owner\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
Screen Saver Control.lnk - c:\winnt\FSScrCtl.exe [2004-01-24 249344]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
GetRight - Tray Icon.lnk - c:\program files\GetRight\getright.exe [2005-09-24 4628752]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.PIM1"= pclepim1.dll
"vidc.ffds"= ffdshow.ax
"msacm.ac3filter"= ac3filter.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\support\\bin\\win\\RosettaStoneLtdServices.exe"=
"c:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\RosettaStoneVersion3.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service
"<NO NAME>"=
"57156:TCP"= 57156:TCP:Pando P2P TCP Listening Port
"57156:UDP"= 57156:UDP:Pando P2P UDP Listening Port
R1 aswSP;avast! Self Protection;c:\winnt\system32\drivers\aswSP.sys [2009-03-27 114768]
R2 aswFsBlk;aswFsBlk;c:\winnt\system32\drivers\aswFsBlk.sys [2009-03-27 20560]
R2 LicCtrlService;LicCtrl Service;c:\winnt\Runservice.exe [2008-10-15 2560]
R2 YahooAUService;Yahoo! Updater;c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe [2008-11-09 602392]
R3 FLASHREADER;USB Reader;c:\winnt\system32\drivers\camusb.sys [1979-12-31 25216]
S1 117d6292;117d6292;c:\winnt\system32\drivers\117d6292.sys --> c:\winnt\system32\drivers\117d6292.sys [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-12-11 33752]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
MespW
Ouken
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
c:\winnt\system32\rundll32.exe c:\winnt\system32\advpack.dll,LaunchINFSectionEx c:\program files\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12
.
Contents of the 'Scheduled Tasks' folder
2009-02-14 c:\winnt\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - ORPHANS REMOVED - - - -
BHO-{082874E6-7542-4935-AE3E-70FA93AD2244} - (no file)
BHO-{23502185-02D6-4A95-AA2C-FFB426DF934D} - (no file)
BHO-{2E371025-D2FA-48C2-87E2-C3876309E889} - (no file)
BHO-{6127B8EB-9029-4272-96B8-B85023440CFC} - (no file)
BHO-{711AB4CA-3EE7-49D1-9FDE-6312DC3540DF} - (no file)
BHO-{72F305DC-5DBD-4F24-87C9-1F0AA03C32CE} - (no file)
BHO-{7B724A89-4D3D-48E5-8186-8ABAC7595D9E} - (no file)
BHO-{7F74FE62-B043-4477-822D-D13D44297C6D} - (no file)
BHO-{8350CB80-6ECD-4F2C-A89D-600831FFAA61} - (no file)
BHO-{8A6FB44E-6F96-4972-9B0A-B4604497EC65} - (no file)
BHO-{95768BFD-5D96-4D10-95A2-91975E1CF38D} - (no file)
BHO-{A74A11BF-0437-4B05-A1C0-01E5D0F8B3CC} - (no file)
BHO-{B1B95662-608A-4340-8FAB-79DAE16072D7} - (no file)
BHO-{B612F991-D9CE-469D-9738-B3A3AA7185CB} - (no file)
BHO-{BBF82CA3-7093-42A6-A4BE-492FEE0E2288} - (no file)
BHO-{C52EA57A-F4A0-4589-B8FB-0280EC000242} - (no file)
BHO-{C5F74968-726B-42F7-AC61-87F40E9F491A} - (no file)
BHO-{DBC1CB0C-2E5A-4945-9BEA-671A8091D111} - (no file)
BHO-{E7823DBF-7D4C-4DB3-9531-A9B21BE03593} - (no file)
Toolbar-Locked - (no file)
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uStart Page = hxxp://images.google.com/imghp?hl=en
mStart Page = hxxp://www.yahoo.com/?fr=fp-yie8
uInternet Connection Wizard,ShellNext = hxxp://www.gateway.net/
uInternet Settings,ProxyOverride = *.local
DPF: {7D731A83-6C80-4EA4-9646-5E06A0513274} - hxxp://www.shockwave.com/content/barnyardinvasion/sis/slgwebinstall.cab
DPF: {87056D28-9730-4A47-B9F9-7E890B62C58A} - hxxp://www.shockwave.com/content/ghostfrenzy/sis/axhost.cab
DPF: {90918C20-FB99-495A-BD79-CB91ACF44887} - hxxp://www.typingmaster.com/contents/tm2002/oneclick/TMSetup.cab
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\kj32c38l.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - GoogleCOM
FF - prefs.js: browser.startup.homepage - hxxp://images.google.com/imghp?hl=en&tab=wi
FF - prefs.js: keyword.URL - hxxp://www.wcsearch.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPGetRt.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
---- FIREFOX POLICIES ----
FF - user.js: browser.search.selectedEngine - GoogleCOM
FF - user.js: keyword.URL - hxxp://www.wcsearch.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-05 20:52:11
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \04F7528984592EA0]
"1"=hex:d5,3e,50,00,82,25,c9,f6,dd,f6,18,c9,99,5b,70,06,b4,b6,07,c1,1b,95,01,
2f
"2"=hex:e4,d7,da,38,b0,b5,3c,88,a2,01,5f,80,71,fc,07,41,22,5f,c1,26,5d,01,8c,
86
"3"=hex:d5,3e,50,00,82,25,c9,f6,dd,f6,18,c9,99,5b,70,06,53,86,fb,a3,af,c0,18,
8b,f9,e5,ef,ce,f2,5f,47,59,1f,2b,25,f6,12,48,81,74
[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \04F7528984592EA0\FD1E79A92259B5BC6F3673C7C70B3F80]
"1"=hex:a0,05,e5,14,70,56,59,19,19,f2,d5,d0,45,ea,42,c8,7b,0e,8f,12,8d,fe,0d,
89,e7,25,77,a8,98,63,f3,0c
"2"=hex:03,13,8a,80,bd,85,45,8e
"3"=hex:a2,64,f1,6f,8c,e0,34,8f,eb,ec,fc,19,df,46,d2,40,db,d8,17,55,7a,be,5f,
f2,d1,db,11,d7,36,8b,87,3b,b3,9c,c1,5b,f3,80,c3,dd,1b,84,70,63,e0,09,0c,1f,\
"4"=hex:bd,75,77,15,24,56,01,85
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
"7"=hex:c9,3a,93,65,d5,aa,5c,a5,af,ff,f0,6c,ea,dc,3b,16,d5,46,14,1e,de,21,e3,
92,5e,f6,28,50,86,1e,42,82,78,98,b2,16,ef,bb,c5,35,e6,7b,97,84,6e,7c,e4,9d,\
"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,d5,51,9f,32,fb,06,fa,
8c,e8,22,fe,5a,96,f6,72,ff,b7,d3,87,b3,8d,54,9f,32,5f,3a,e2,a1,97,10,45,b9,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:70,56,26,33,e3,20,f8,ab
"10"=hex:c7,b0,18,85,7b,39,96,ed
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:81,20,8f,ab,28,6a,52,9c
"13"=hex:81,20,8f,ab,28,6a,52,9c
"14"=hex:81,20,8f,ab,28,6a,52,9c
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:81,20,8f,ab,28,6a,52,9c
"22"=hex:81,20,8f,ab,28,6a,52,9c
.
Completion time: 2009-04-05 20:59:24
ComboFix-quarantined-files.txt 2009-04-06 03:58:01
ComboFix2.txt 2009-03-22 23:10:52
Pre-Run: 10,609,975,296 bytes free
Post-Run: 10,748,235,776 bytes free
290 --- E O F --- 2009-03-20 08:00:11