نحلت المشكلة أخي فارس الملاك ..... بارك الله فييييك ..... والله إنك مشرف حقيقي وسرعة تلبيتك لطلبي تأكد هذا
الأداة نزلتها وكانت نتيجتها صاروخية ... ورجع الديسك توب زي ما كان.. شكراً مرة أخرى أخي المشرف ,,,,, وهذا سيشجعني على التمسك بالمنتدى والمشاركة فيه
بارك الله فيك وفي جميع الأعضاء
وهذا التقرير اللي طلعلي
ComboFix 08-09-19.09 - africa 2008-09-20 14:45:17.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.461 [GMT 3:00]
Running from: C:\Documents and Settings\africa.PC1.000\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\BrowserSearch\BrowserSearch.xml
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\BrowserSearch\BrowserSearch.xml.backup
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Button_5\Button_5Options.xml
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Button_5\Button_5Options.xml.backup
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Button_6\Button_6Options.xml
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Button_6\Button_6Options.xml.backup
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Button_7\Button_7Options.xml
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Button_7\Button_7Options.xml.backup
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Configurator\Configurator.xml
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Configurator\Configurator.xml.backup
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\ErrorSearch\ErrorSearchOptions.xml
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\ErrorSearch\ErrorSearchOptions.xml.backup
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Layouts\ToolbarLayout.xml
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Layouts\ToolbarLayout.xml.backup
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Layouts\WeatherLayout.xml
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Layouts\WeatherLayout.xml.backup
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Manager\ManagerOptions.xml
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Manager\ManagerOptions.xml.backup
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Reference\ReferenceOptions.xml
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Reference\ReferenceOptions.xml.backup
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\RelatedSearch\RelatedSearchOptions.xml
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\RelatedSearch\RelatedSearchOptions.xml.backup
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Screensavers\ScreensaversOptions.xml
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Screensavers\ScreensaversOptions.xml.backup
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Tem18.tmp
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Tem1B.tmp
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Tem3.tmp
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\TemC.tmp
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Toolbar\TBProductsOptions.xml
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Toolbar\TBProductsOptions.xml.backup
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\ToolbarLogo\ToolbarLogoOptions.xml
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\ToolbarLogo\ToolbarLogoOptions.xml.backup
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\ToolbarSearch\ToolbarSearchOptions.xml
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\ToolbarSearch\ToolbarSearchOptions.xml.backup
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\TravelSearch\TravelSearchOptions.xml
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\TravelSearch\TravelSearchOptions.xml.backup
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Weather\AlertArchive.xml
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Weather\WeatherOptions.xml
C:\Documents and Settings\africa.PC1.000\Application Data\Starware386\Weather\WeatherOptions.xml.backup
C:\Documents and Settings\All Users\Application Data\pdfdoc2.dll
C:\Documents and Settings\All Users\Application Data\pdfppt2.dll
C:\Documents and Settings\All Users\Application Data\pdfxls2.dll
C:\Documents and Settings\All Users\Application Data\Starware386
C:\Documents and Settings\All Users\Application Data\Starware386\buttons\1154_button_1b_def.bmp
C:\Documents and Settings\All Users\Application Data\Starware386\buttons\1154_button_1b_over.bmp
C:\Documents and Settings\All Users\Application Data\Starware386\buttons\Button_50.bmp
C:\Documents and Settings\All Users\Application Data\Starware386\buttons\Button_60.bmp
C:\Documents and Settings\All Users\Application Data\Starware386\buttons\Button_70.bmp
C:\Documents and Settings\All Users\Application Data\Starware386\buttons\FindIt.bmp
C:\Documents and Settings\All Users\Application Data\Starware386\buttons\FindItHot.bmp
C:\Documents and Settings\All Users\Application Data\Starware386\buttons\findithotxp.png
C:\Documents and Settings\All Users\Application Data\Starware386\buttons\finditxp.png
C:\Documents and Settings\All Users\Application Data\Starware386\buttons\logo.bmp
C:\Documents and Settings\All Users\Application Data\Starware386\buttons\logoxp.bmp
C:\Documents and Settings\All Users\Application Data\Starware386\buttons\Reference.bmp
C:\Documents and Settings\All Users\Application Data\Starware386\buttons\ReferenceHot.bmp
C:\Documents and Settings\All Users\Application Data\Starware386\buttons\referencehotxp.png
C:\Documents and Settings\All Users\Application Data\Starware386\buttons\referencexp.png
C:\Documents and Settings\All Users\Application Data\Starware386\buttons\Weather.bmp
C:\Documents and Settings\All Users\Application Data\Starware386\buttons\WeatherHot.bmp
C:\Documents and Settings\All Users\Application Data\Starware386\buttons\weatherhotxp.png
C:\Documents and Settings\All Users\Application Data\Starware386\buttons\weatherxp.png
C:\Documents and Settings\All Users\Application Data\Starware386\contexts\error.xml
C:\Documents and Settings\All Users\Application Data\Starware386\contexts\Related.xml
C:\Documents and Settings\All Users\Application Data\Starware386\contexts\Travel.xml
C:\Documents and Settings\All Users\Application Data\Starware386\images\walertXP.bmp
C:\Documents and Settings\All Users\Application Data\Starware386\SimpleUpdate\ProductMessagingConfig.xml
C:\Documents and Settings\All Users\Application Data\Starware386\SimpleUpdate\ProductMessagingConfig.xml.backup
C:\Documents and Settings\All Users\Application Data\Starware386\SimpleUpdate\SimpleUpdateConfig.xml
C:\Documents and Settings\All Users\Application Data\Starware386\SimpleUpdate\SimpleUpdateConfig.xml.backup
C:\Documents and Settings\All Users\Application Data\Starware386\SimpleUpdate\TimerManagerConfig.xml
C:\Documents and Settings\All Users\Application Data\Starware386\SimpleUpdate\TimerManagerConfig.xml.backup
C:\Program Files\Bifrost
C:\Program Files\Hotbar
C:\Program Files\Hotbar\
0.bmp
C:\Program Files\Hotbar\DH background.bmp
C:\Program Files\Hotbar\Readme.txt
C:\Program Files\Hotbar\Skin Bar 2000.exe
C:\Program Files\Hotbar\SkinS\
0102STR.BMP
C:\Program Files\Hotbar\SkinS\
0201skinblue.bmp
C:\Program Files\Hotbar\SkinS\
0208nrainbow1.bmp
C:\Program Files\Hotbar\SkinS\
0208underwtr.bmp
C:\Program Files\Hotbar\SkinS\
0211plane.bmp
C:\Program Files\Hotbar\SkinS\
0221AudioCast.bmp
C:\Program Files\Hotbar\SkinS\
0221Sun2.bmp
C:\Program Files\Hotbar\SkinS\
0223ethinkingonlyyou.bmp
C:\Program Files\Hotbar\SkinS\
0223sunsetorang.bmp
C:\Program Files\Hotbar\SkinS\
0224bdesert.bmp
C:\Program Files\Hotbar\SkinS\
0224DaBlob.bmp
C:\Program Files\Hotbar\SkinS\
0229Solar.bmp
C:\Program Files\Hotbar\SkinS\
0326ZBWCheetah3.bmp
C:\Program Files\Hotbar\SkinS\
0403iMBear50.bmp
C:\Program Files\Hotbar\SkinS\
0403ipeace.bmp
C:\Program Files\Hotbar\SkinS\
0406ZMWHawaiiSunset1.bmp
C:\Program Files\Hotbar\SkinS\
0407Zfragilelife.bmp
C:\Program Files\Hotbar\SkinS\
0407Zsunset2.bmp
C:\Program Files\Hotbar\SkinS\
0523ZLarryC04.bmp
C:\Program Files\Hotbar\SkinS\
0525ZAliR01.bmp
C:\Program Files\Hotbar\SkinS\
0611Kemi3.bmp
C:\Program Files\Hotbar\SkinS\
0618Kdv_tspace6.bmp
C:\Program Files\Hotbar\SkinS\
0712Kdv_usa30.bmp
C:\Program Files\Hotbar\SkinS\
0713ZSLopez01.bmp
C:\Program Files\Hotbar\SkinS\1227edancewithme.bmp
C:\Program Files\Hotbar\SkinS\1801Rainbow2.bmp
C:\Program Files\Hotbar\SkinS\Madonna_Deeper.bmp
C:\Program Files\Hotbar\SkinS\Madonna_Frozen.bmp
C:\Program Files\Hotbar\SkinS\Madonna_ROL.bmp
C:\Program Files\Hotbar\SkinS\Madonna_ROL2.bmp
C:\Program Files\Hotbar\SkinS\Madonna2.bmp
C:\Program Files\Hotbar\SkinS\Thumbs.db
C:\Program Files\Hotbar\Thumbs.db
C:\Program Files\Microsoft Common
C:\Program Files\Starware386
C:\Program Files\Starware386\icons\star_16.ico
C:\Program Files\Starware386\Starware386Config.xml
C:\WINDOWS\ktd32.atm
C:\WINDOWS\system32\config\SAM.SAV
C:\WINDOWS\system32\m32
C:\WINDOWS\system32\nusrmgr.exe
C:\WINDOWS\system32\svcp.csv
C:\WINDOWS\system32\winsub.xml
.
((((((((((((((((((((((((( Files Created from 2008-08-20 to 2008-09-20 )))))))))))))))))))))))))))))))
.
2008-09-20 13:45 . 2008-09-20 13:45 <DIR> d-------- C:\Documents and Settings\africa.PC1.000\Application Data\Thinstall
2008-09-17 14:42 . 2008-09-17 14:42 3,074 --a------ C:\Enlish.lng
2008-09-17 14:36 . 2008-09-20 13:21 <DIR> d-------- C:\Program Files\RegDoctor
2008-09-17 14:36 . 2005-02-12 16:43 245,760 --a------ C:\WINDOWS\system32\vbalColumnTreeView6.ocx
2008-09-17 14:36 . 1999-08-02 17:11 57,344 --a------ C:\WINDOWS\system32\CGZipLibrary.DLL
2008-09-17 14:36 . 1999-03-12 02:20 18,728 --a------ C:\WINDOWS\system32\ISHF_Ex.tlb
2008-09-17 14:36 . 1998-03-18 17:45 8,096 --a------ C:\WINDOWS\system32\OLEGUIDS.TLB
2008-09-17 13:19 . 2008-09-17 13:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-09-17 13:19 . 2008-09-17 13:19 <DIR> d-------- C:\Documents and Settings\africa.PC1.000\Application Data\TuneUp Software
2008-09-17 13:19 . 2008-09-17 13:19 306,432 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-09-17 13:19 . 2007-12-20 10:41 29,440 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-09-17 13:18 . 2008-09-17 13:19 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-09-17 13:18 . 2008-09-17 13:18 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-17 13:11 . 2008-09-17 13:11 <DIR> d-------- C:\Program Files\fermqbe
2008-09-17 13:11 . 2008-09-17 13:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-09-17 13:11 . 2008-09-17 13:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\dknuzids
2008-09-17 13:10 . 2008-09-17 13:10 <DIR> d-------- C:\Program Files\Desktop Icon Toy
2008-09-17 13:10 . 2008-09-17 13:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-09-17 13:10 . 2008-09-17 13:10 <DIR> d-------- C:\Documents and Settings\africa.PC1.000\Application Data\Consultia
2008-09-17 12:12 . 2008-09-17 13:08 <DIR> d-------- C:\Documents and Settings\Administrator
2008-09-10 11:23 . 2008-09-17 13:08 <DIR> d-------- C:\Program Files\SubFind
2008-09-10 11:23 . 2003-01-26 14:41 40,960 --a------ C:\WINDOWS\system32\SSubTmr6.dll
2008-09-08 09:56 . 2008-09-17 13:08 <DIR> d-------- C:\Program Files\Advanced JPEG Compressor
2008-09-06 15:20 . 2008-09-06 15:20 <DIR> d-------- C:\Documents and Settings\africa.PC1.000\Application Data\Grisoft
2008-09-06 15:20 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-09-02 12:50 . 2008-09-17 13:08 <DIR> d-------- C:\Program Files\BitComet
2008-08-30 14:56 . 2008-09-17 13:08 <DIR> d-------- C:\Program Files\AnswerWorks 4.0
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-20 11:46 --------- d-----w C:\Documents and Settings\africa.PC1.000\Application Data\DMCache
2008-09-17 10:11 --------- d-----w C:\Program Files\Internet Download Manager
2008-09-17 10:11 --------- d-----w C:\Program Files\Gabest
2008-09-17 10:11 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2008-09-17 10:11 --------- d-----w C:\Program Files\AutoCAD 2006
2008-09-17 10:11 --------- d-----w C:\Documents and Settings\africa.PC1.000\Application Data\IDM
2008-09-17 10:10 --------- d-----w C:\Program Files\CubeDesktop
2008-09-17 10:10 --------- d-----w C:\Program Files\Conduit
2008-09-17 10:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
2008-09-11 10:45 --------- d-----w C:\Documents and Settings\africa.PC1.000\Application Data\Skype
2008-09-02 09:50 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll
2008-08-18 12:00 --------- d-----w C:\Program Files\No-IP
2008-07-31 13:49 --------- d-----w C:\Documents and Settings\africa.PC1.000\Application Data\WengoPhone
2008-07-30 12:43 --------- d-----w C:\Program Files\iTunes
2008-07-30 12:43 --------- d-----w C:\Documents and Settings\africa.PC1.000\Application Data\Apple Computer
2008-07-30 12:42 --------- d-----w C:\Program Files\iPod
2008-07-30 12:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-30 12:41 --------- d-----w C:\Program Files\QuickTime
2008-07-30 12:40 --------- d-----w C:\Program Files\Apple Software Update
2008-07-30 12:39 --------- d-----w C:\Program Files\Common Files\Apple
2008-07-30 12:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-07-28 08:14 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-23 11:25 --------- d-----w C:\Program Files\Save Flash
2008-07-23 11:08 --------- d-----w C:\Program Files\PIXresizer
2008-07-09 14:34 206,256 ----a-w C:\WINDOWS\system32\idmmbc.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RegDoctor"="C:\Program Files\RegDoctor\RegDoctor.exe" [2007-08-14 2256896]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
"NoMovingBands"= 0 (0x0)
"NoCloseDragDropBands"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceDelayLoad]
"ChkDb"= {13F9CD4B-40FD-3364-C3EC-0AE11E190585} - C:\Program Files\fermqbe\ChkDb.dll [2008-09-16 106496]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.3iv2"= 3ivxVfWCodec.dll
"VIDC.VP31"= vp31vfw.dll
"msacm.l3fhg"= mp3fhg.acm
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
backup=C:\WINDOWS\pss\AutoCAD Startup Accelerator.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
--a------ 2007-06-11 12:25 6731312 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-07-10 09:47 116040 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ClocX]
--a------ 2004-04-13 17:12 103936 C:\Program Files\ClocX\ClocX.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 01:56 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui]
--a------ 2008-02-20 11:06 1443072 C:\Program Files\ESET\ESET Smart Security\egui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPWS myPrintMileage Agent]
--a------ 2004-10-31 06:47 102400 C:\Program Files\Hewlett-Packard\HP Deskjet 1280\Toolbox\mpm.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-07-10 10:51 289064 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
--a------ 2008-05-27 21:58 4269296 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 02:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-01-19 16:39 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 2005-05-03 18:43 69632 C:\WINDOWS\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 2007-01-30 18:54 16116224 C:\WINDOWS\RTHDCPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiSPower]
--a------ 2007-02-28 13:33 53248 C:\WINDOWS\system32\SiSPower.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
--a------ 2006-05-16 18:04 2879488 C:\WINDOWS\SkyTel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"MSConfig"=C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"20269:TCP"= 20269:TCP:BitComet 20269 TCP
"20269:UDP"= 20269:UDP:BitComet 20269 UDP
"6881:TCP"= 6881:TCP:BitComet 6881 TCP
"6881:UDP"= 6881:UDP:BitComet 6881 UDP
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 14336]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-09-17 306432]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1352B1E7-83EE-60DE-0000-000608060108}]
C:\WINDOWS\system32\ocx.exe
.
s of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -
Notify-WgaLogon - (no file)
MSConfigStartUp-AVP - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
MSConfigStartUp-MsnMsgr - C:\Program Files\MSN Messenger\MsnMsgr.Exe
MSConfigStartUp-WengoPhoneNG - C:\Program Files\WengoPhone\qtwengophone.exe
MSConfigStartUp-Yahoo! Pager - C:\Program Files\Yahoo!\Messenger\ypager.exe
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\africa.PC1.000\Application Data\Mozilla\Firefox\Profiles\
0mhfm93q.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:ar
fficial
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-09-20 14:47:01
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-09-20 14:47:50
ComboFix-quarantined-files.txt 2008-09-20 11:47:47
Pre-Run: 24,308,375,552 bytes free
Post-Run: 24,666,771,456 bytes free
303
