هذا التقرير
ComboFix 08-08-03.05 - WIN XP 08/04/2008 21:53:44.9 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.678 [GMT 3:00]
Running from: C:\Documents and Settings\WIN XP\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-07-04 to 2008-08-04 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-04 18:56 8,727,072 --sha-w C:\windows\system32\drivers\fidbox.dat
2008-08-04 18:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-04 18:24 271,136 --sha-w C:\windows\system32\drivers\fidbox2.dat
2008-08-04 18:24 25,832 --sha-w C:\windows\system32\drivers\fidbox2.idx
2008-08-04 18:24 120,980 --sha-w C:\windows\system32\drivers\fidbox.idx
2008-08-04 17:19 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\byteamenlive
2008-08-02 06:57 --------- d-----w C:\Program Files\Common Files\Macromedia
2008-08-02 06:56 --------- d-----w C:\Program Files\Opera 9.5 alpha
2008-08-02 06:56 --------- d-----w C:\Program Files\Macromedia
2008-08-02 06:54 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-02 04:20 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-02 04:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-08-02 04:17 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2008-08-02 04:02 367 ----a-w C:\Documents and Settings\WIN XP\ie_updates3r.exe
2008-08-01 23:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trans Once Mess Frag
2008-07-31 22:07 --------- d-----w C:\Program Files\Internet Download Manager
2008-07-31 14:37 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\IDM
2008-07-31 14:36 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\DMCache
2008-07-31 08:13 --------- d-----w C:\Program Files\Yahoo!
2008-07-31 08:07 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\CyberScrub
2008-07-31 08:05 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\cleaner
2008-07-30 08:27 --------- d-----w C:\Program Files\iISystem Wiper
2008-07-30 01:56 --------- d-----w C:\Program Files\SWiSHmax
2008-07-26 20:45 --------- d-----w C:\Program Files\Bifrost
2008-07-25 10:43 --------- d-----w C:\Program Files\Microsoft VM
2008-07-24 15:38 --------- d-----w C:\Program Files\swfscanner
2008-07-23 20:54 --------- d-----w C:\Program Files\Circle Developement
2008-07-23 16:13 96,559 ----a-w C:\windows\system32\drivers\klin.dat
2008-07-23 16:13 87,855 ----a-w C:\windows\system32\drivers\klick.dat
2008-07-23 16:13 112,144 ----a-w C:\windows\system32\drivers\kl1.sys
2008-07-23 15:41 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Yahoo!
2008-07-23 15:38 --------- d-----w C:\Program Files\Kaspersky Lab
2008-07-23 12:19 --------- d-----w C:\Program Files\Google
2008-07-23 10:14 --------- d-----w C:\Program Files\Trojan Remover
2008-07-23 10:12 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-23 03:57 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\Simply Super Software
2008-07-22 08:48 --------- d-----w C:\Program Files\byteamenlive
2008-07-20 19:33 --------- d-----w C:\Program Files\WMV9_VCM
2008-07-20 19:33 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\MAGIX
2008-07-20 19:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\MAGIX
2008-07-20 19:32 --------- d-----w C:\Program Files\Common Files\Xara
2008-07-20 19:31 --------- d-----w C:\Program Files\Xara
2008-07-20 19:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Xara
2008-07-20 12:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-20 07:43 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\DivX
2008-07-20 04:34 407,129 ----a-w C:\windows\MarioForever_Toolbar_Uninstaller_3578.exe
2008-07-20 04:34 --------- d-----w C:\Program Files\Mario Forever Toolbar
2008-07-20 04:34 --------- d-----w C:\Program Files\Mario Forever
2008-07-19 05:04 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\Yahoo!
2008-07-19 05:03 --------- d-----w C:\Program Files\DivX
2008-07-18 05:36 --------- d-----w C:\Program Files\NOS
2008-07-18 05:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\NOS
2008-07-18 00:38 778,240 ----a-w C:\windows\system32\ALOAudioCompress2.dll
2008-07-15 09:10 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\TurboFTP
2008-07-09 04:23 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\SmartFTP
2008-07-09 04:20 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\BPFTP
2008-07-09 04:16 --------- d-----w C:\Program Files\LeapFTP
2008-07-08 15:19 1,245,184 ----a-w C:\windows\system32\bkll.dll
2008-07-02 10:33 82,432 ----a-w C:\windows\system32\IEDFix.C.exe
2008-06-20 10:44 --------- d-----w C:\Program Files\MSN Messenger
2008-06-20 08:51 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-06-18 17:52 161,096 ----a-w C:\windows\system32\DivXCodecVersionChecker.exe
2008-06-11 00:07 524,288 ----a-w C:\windows\system32\DivXsm.exe
2008-06-11 00:07 43,528 ------w C:\windows\system32\drivers\PxHelp20.sys
2008-06-11 00:07 3,596,288 ----a-w C:\windows\system32\qt-dx331.dll
2008-06-11 00:07 129,784 ------w C:\windows\system32\pxafs.dll
2008-06-11 00:07 120,056 ------w C:\windows\system32\pxcpyi64.exe
2008-06-11 00:07 118,520 ------w C:\windows\system32\pxinsi64.exe
2008-06-11 00:04 200,704 ----a-w C:\windows\system32\ssldivx.dll
2008-06-11 00:04 1,044,480 ----a-w C:\windows\system32\libdivx.dll
2008-06-05 10:11 --------- d-----w C:\Program Files\Golden Al-Wafi Translator
2008-06-05 07:14 45,056 ----a-w C:\windows\NCUNINST.EXE
2008-06-05 07:12 --------- d-----w C:\Program Files\Common Files\SWF Studio
2008-05-29 06:35 86,528 ----a-w C:\windows\system32\VACFix.exe
2008-05-23 15:21 81,920 ----a-w C:\windows\system32\404Fix.exe
2008-05-22 22:18 12,288 ----a-w C:\windows\system32\DivXWMPExtType.dll
2008-05-07 12:09 311,296 ----a-w C:\windows\FastFolders.dll
2008-05-07 12:09 28,672 ----a-w C:\windows\FFUninst.exe
2008-05-05 18:06 158,456 ------w C:\windows\system32\pxwma.dll
2008-03-14 20:19 157 ----a-w C:\Program Files\COM.NET.txt
.
(((((((((((((((((((((((((((((
snapshot@Sat 07-26-2008_23.57.18.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-02-25 03:35:05 14,048 ----a-w C:\windows\$hf_mig$\KB898461\spmsg.dll
+ 2005-02-25 03:35:05 209,632 ----a-w C:\windows\$hf_mig$\KB898461\spuninst.exe
+ 2005-02-25 03:35:05 22,752 ----a-w C:\windows\$hf_mig$\KB898461\spupdsvc.exe
+ 2005-02-25 03:35:05 22,240 ----a-w C:\windows\$hf_mig$\KB898461\update\spcustom.dll
+ 2005-02-25 03:35:05 718,048 ----a-w C:\windows\$hf_mig$\KB898461\update\update.exe
+ 2005-02-25 03:35:06 371,936 ----a-w C:\windows\$hf_mig$\KB898461\update\updspapi.dll
+ 2007-10-26 03:34:01 8,460,288 ----a-w C:\windows\$hf_mig$\KB943460\SP2QFE\shell32.dll
+ 2007-10-29 10:04:03 350,720 ----a-w C:\windows\$hf_mig$\KB943460\SP2QFE\xpsp3res.dll
+ 2007-03-06 01:22:33 14,048 ----a-w C:\windows\$hf_mig$\KB943460\spmsg.dll
+ 2007-03-06 01:22:39 213,216 ----a-w C:\windows\$hf_mig$\KB943460\spuninst.exe
+ 2007-03-06 01:22:31 22,752 ----a-w C:\windows\$hf_mig$\KB943460\update\spcustom.dll
+ 2007-03-06 01:22:56 716,000 ----a-w C:\windows\$hf_mig$\KB943460\update\update.exe
+ 2007-03-06 01:23:47 371,424 ----a-w C:\windows\$hf_mig$\KB943460\update\updspapi.dll
+ 2005-02-25 03:35:05 209,632 -c----w C:\windows\$NtUninstallKB898461$\spuninst\spuninst.exe
+ 2005-02-25 03:35:06 371,936 -c----w C:\windows\$NtUninstallKB898461$\spuninst\updspapi.dll
+ 2007-10-25 16:42:42 8,445,952 -c----w C:\windows\$NtUninstallKB943460$\shell32.dll
+ 2007-03-06 01:22:39 213,216 -c----w C:\windows\$NtUninstallKB943460$\spuninst\spuninst.exe
+ 2007-03-06 01:23:47 371,424 -c----w C:\windows\$NtUninstallKB943460$\spuninst\updspapi.dll
+ 2005-08-31 01:31:28 120,464 ----a-w C:\windows\Downloaded Installations\Macromedia Flash 8\FL_Client_Installer.exe
+ 2005-04-04 11:49:16 2,003,176 ----a-w C:\windows\Downloaded Installations\Macromedia Flash 8\WindowsInstaller-KB884016-v2-x86.exe
+ 2008-08-02 04:17:45 65,536 ----a-r C:\windows\Installer\{236BB7C4-4419-42FD-0409-1E257A25E34D}\NewShortcut1_236BB7C4441942FD04091E257A25E34D.exe
+ 2008-08-02 06:58:45 65,536 ----a-r C:\windows\Installer\{2BD5C305-1B27-4D41-B690-7A61172D2FEB}\ARPPRODUCTICONFL8.exe
+ 2008-08-02 06:55:28 65,536 ----a-r C:\windows\Installer\{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}\EMARPPRODUCTICON.exe
+ 2008-08-02 06:55:46 53,248 ----a-r C:\windows\Installer\{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}\ARPPRODUCTICONFLV1.exe
+ 2008-08-02 04:19:11 65,536 ----a-r C:\windows\Installer\{B74D4E10-1033-0000-0000-000000000001}\AdobeBridge_B74D4E10103300000000000000000001_1.exe
+ 2008-08-02 04:19:11 65,536 ----a-r C:\windows\Installer\{B74D4E10-1033-0000-0000-000000000001}\BridgeCommonShortcut_B74D4E101033000000000001_1.exe
+ 2008-08-02 04:19:11 1,904,640 ----a-r C:\windows\Installer\{B74D4E10-1033-0000-0000-000000000001}\ESLaunchShortcut_B74D4E10103300000000000000000001.exe
+ 2008-08-02 04:19:11 61,440 ----a-r C:\windows\Installer\{B74D4E10-1033-0000-0000-000000000001}\NewShortcut2_B74D4E10103300000000000000000001.exe
+ 2008-08-02 04:22:41 65,536 ----a-r C:\windows\Installer\{E9787678-1033-0000-8E67-000000000001}\AppLanuchShortcut_E9787678103300008E67000000000001_1.exe
+ 2008-08-02 04:22:41 65,536 ----a-r C:\windows\Installer\{E9787678-1033-0000-8E67-000000000001}\ProgramMenuShortcut_E9787678103300008E670000000001_1.exe
- 2004-08-03 22:56:42 66,560 ----a-w C:\windows\system32\cdm.dll
+ 2007-07-30 16:19:20 92,504 ----a-w C:\windows\system32\cdm.dll
- 2004-08-03 22:56:42 66,560 -c--a-w C:\windows\system32\dllcache\cdm.dll
+ 2007-07-30 16:19:20 92,504 -c--a-w C:\windows\system32\dllcache\cdm.dll
- 2004-08-03 22:56:46 8,384,000 -c--a-w C:\windows\system32\dllcache\shell32.dll
+ 2007-10-26 03:36:51 8,454,656 -c--a-w C:\windows\system32\dllcache\shell32.dll
- 2004-08-03 22:56:48 430,592 -c--a-w C:\windows\system32\dllcache\wuapi.dll
+ 2007-07-30 16:19:36 549,720 -c--a-w C:\windows\system32\dllcache\wuapi.dll
- 2004-08-03 22:56:58 111,104 -c--a-w C:\windows\system32\dllcache\wuauclt.exe
+ 2007-07-30 16:19:16 53,080 -c--a-w C:\windows\system32\dllcache\wuauclt.exe
- 2004-08-03 22:56:48 1,134,592 -c--a-w C:\windows\system32\dllcache\wuaueng.dll
+ 2007-07-30 16:19:42 1,712,984 -c--a-w C:\windows\system32\dllcache\wuaueng.dll
- 2004-08-03 22:56:48 112,640 -c--a-w C:\windows\system32\dllcache\wucltui.dll
+ 2007-07-30 16:19:32 325,976 -c--a-w C:\windows\system32\dllcache\wucltui.dll
- 2004-08-03 22:56:48 36,864 -c--a-w C:\windows\system32\dllcache\wups.dll
+ 2007-07-30 16:18:40 33,624 -c--a-w C:\windows\system32\dllcache\wups.dll
- 2004-08-03 22:56:48 120,320 -c--a-w C:\windows\system32\dllcache\wuweb.dll
+ 2007-07-30 16:19:46 203,096 -c--a-w C:\windows\system32\dllcache\wuweb.dll
+ 2004-07-31 15:50:36 51,200 ----a-w C:\windows\system32\dumphive.exe
- 2008-07-21 00:30:13 469,984 ----a-w C:\windows\system32\FNTCACHE.DAT
+ 2008-08-03 20:16:18 30,576 ----a-w C:\windows\system32\FNTCACHE.DAT
+ 2008-03-20 15:06:36 1,480,232 ------w C:\windows\system32\LegitCheckControl.dll
- 2007-11-20 13:52:00 2,884,992 ----a-w C:\windows\system32\Macromed\Flash\NPSWF32.dll
+ 2005-08-27 11:08:06 1,398,408 ----a-w C:\windows\system32\Macromed\Flash\NPSWF32.dll
- 2008-07-26 20:03:04 41,170 ----a-w C:\windows\system32\perfc009.dat
+ 2008-08-04 18:56:14 41,170 ----a-w C:\windows\system32\perfc009.dat
- 2008-07-26 20:03:04 314,842 ----a-w C:\windows\system32\perfh009.dat
+ 2008-08-04 18:56:14 314,842 ----a-w C:\windows\system32\perfh009.dat
+ 2003-06-05 18:13:00 53,248 ----a-w C:\windows\system32\Process.exe
+ 2005-08-05 05:52:14 1,642,496 ----a-w C:\windows\system32\QuickTime\MMxptResources.dll
- 2004-08-03 22:56:46 8,384,000 ----a-w C:\windows\system32\shell32.dll
+ 2007-10-26 03:36:51 8,454,656 ----a-w C:\windows\system32\shell32.dll
+ 2007-07-30 16:19:36 549,720 ----a-w C:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wuapi.dll\7.0.6000.381\wuapi.dll
+ 2007-07-30 16:18:40 33,624 ----a-w C:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.0.6000.381\wups.dll
- 2006-09-06 14:43:16 14,048 ------w C:\windows\system32\spmsg.dll
+ 2008-03-20 11:41:20 14,640 ------w C:\windows\system32\spmsg.dll
+ 2006-04-27 14:49:30 288,417 ----a-w C:\windows\system32\SrchSTS.exe
+ 2007-09-05 21:22:23 289,144 ----a-w C:\windows\system32\VCCLSID.exe
+ 2007-10-03 21:36:46 25,600 ----a-w C:\windows\system32\WS2Fix.exe
- 2004-08-03 22:56:48 430,592 ----a-w C:\windows\system32\wuapi.dll
+ 2007-07-30 16:19:36 549,720 ----a-w C:\windows\system32\wuapi.dll
- 2004-08-03 22:56:58 111,104 ----a-w C:\windows\system32\wuauclt.exe
+ 2007-07-30 16:19:16 53,080 ----a-w C:\windows\system32\wuauclt.exe
- 2004-08-03 22:56:48 1,134,592 ----a-w C:\windows\system32\wuaueng.dll
+ 2007-07-30 16:19:42 1,712,984 ----a-w C:\windows\system32\wuaueng.dll
- 2004-08-03 22:56:48 112,640 ----a-w C:\windows\system32\wucltui.dll
+ 2007-07-30 16:19:32 325,976 ----a-w C:\windows\system32\wucltui.dll
- 2004-08-03 22:56:48 36,864 ----a-w C:\windows\system32\wups.dll
+ 2007-07-30 16:18:40 33,624 ----a-w C:\windows\system32\wups.dll
+ 2007-07-30 16:19:12 43,352 ----a-w C:\windows\system32\wups2.dll
- 2004-08-03 22:56:48 120,320 ----a-w C:\windows\system32\wuweb.dll
+ 2007-07-30 16:19:46 203,096 ----a-w C:\windows\system32\wuweb.dll
+ 2007-10-29 10:26:53 115,712 ------w C:\windows\system32\xpsp3res.dll
- 1999-12-17 05:13:04 86,016 ----a-w C:\windows\unvise32.exe
+ 2004-03-29 12:23:44 90,112 ----a-w C:\windows\unvise32.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [01/19/2007 12:55 PM 5674352]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [08/04/2004 01:06 AM 1667584]
"ctfmon.exe"="C:\windows\system32\ctfmon.exe" [08/04/2004 01:56 AM 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [03/15/2008 03:26 AM 185896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 01:56 AM 15360]
C:\Documents and Settings\WIN XP\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-03-14 23:39:40 113664]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-03-14 23:39:40 113664]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
backup=C:\WINDOWS\pss\Bluetooth.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 08/04/2004 01:56 AM 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 08/04/2004 01:06 AM 1667584 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Start Save]
--a------ 07/22/2008 11:48 AM 515072 C:\DOCUME~1\WINXP~1\APPLIC~1\BYTEAM~1\Settings sixth beep.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 03/15/2008 03:26 AM 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Macromedia\\Flash MX\\Flash.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\windows\system32\drivers\klbg.sys [01/29/2008 06:29 PM]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\windows\system32\DRIVERS\klim5.sys [03/25/2008 08:07 PM]
R3 tapvpn;TAP VPN Adapter;C:\windows\system32\DRIVERS\tapvpn.sys [06/08/2007 09:52 AM]
S2 TBFTPSyncService;TurboFTP Sync Service;C:\Program Files\TurboFTP\tftpsvc.exe [03/22/2008 09:55 PM]
S4 getPlus(R) Helper;getPlus(R) Helper;C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [06/26/2008 10:24 AM]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{85d1c95f-015d-11dd-ab14-001dd9e6dda7}]
\Shell\AutoRun\command - fooool.exe
\Shell\explore\Command - fooool.exe
\Shell\open\Command - fooool.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cca6ee8e-f2d6-11dc-aad7-001dd9e6dda7}]
\shell\explore\Command - H:\boot.exe
\shell\open\Command - H:\boot.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ecc2a6cb-2520-11dd-abb2-001dd9e6dda7}]
\shell\explore\Command - F:\boot.exe
\shell\open\Command - F:\boot.exe
.
s of the 'Scheduled Tasks' folder
2008-08-04 C:\windows\Tasks\A9EB68D291911A96.job
- c:\docume~1\winxp~1\applic~1\byteam~1\fast defy junk.exe [07/22/2008 11:51 AM]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\WIN XP\Application Data\Mozilla\Firefox\Profiles\avwh84zh.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1561552&SearchSource=3&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://arabia.msn.com/
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-08-04 21:57:01
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 08/04/2008 21:59:33
ComboFix-quarantined-files.txt 2008-08-04 18:59:12
ComboFix2.txt 2008-08-04 11:12:00
ComboFix3.txt 2008-08-03 23:51:59
ComboFix4.txt 2008-08-03 23:41:35
Pre-Run: 23,053,598,720 bytes free
Post-Run: 23,048,953,856 bytes free
276
k:صح لسانك 
