بارك الله فيك أخي على المساعدة ....وهذا هو التقرير الأول :
ComboFix 09-04-04.01 - KAMEL66 2009-04-09 13:09:42.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.735.450 [GMT -7:00]
Running from: c:\documents and settings\KAMEL66\Desktop\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated)
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Administrator.KAMEL\Cookies\GVOPA.GKN
c:\windows\system32\pthreadGC2.dll
.
((((((((((((((((((((((((( Files Created from 2009-03-09 to 2009-04-09 )))))))))))))))))))))))))))))))
.
2009-04-08 17:10 . 2009-04-08 17:10 <DIR> d--hs---- c:\documents and settings\NetworkService\IETldCache
2009-04-08 16:18 . 2009-04-08 16:18 <DIR> d-------- c:\program files\Megaware
2009-04-08 16:08 . 2009-04-08 16:09 <DIR> d-------- c:\program files\DirectX9
2009-04-08 12:13 . 2009-04-08 12:13 <DIR> d-------- c:\program files\Enigma Software Group
2009-04-08 07:56 . 2009-04-08 07:56 <DIR> d-------- c:\documents and settings\KAMEL66\Application Data\AdobeUM
2009-04-07 08:50 . 2009-04-07 08:50 <DIR> d-------- c:\documents and settings\Administrator.KAMEL\Application Data\CyberScrub
2009-04-07 08:50 . 2009-04-07 08:50 <DIR> d-------- c:\documents and settings\Administrator.KAMEL\Application Data\cleaner
2009-04-07 08:44 . 2009-04-07 08:44 <DIR> d--hs---- c:\documents and settings\Administrator.KAMEL\IETldCache
2009-04-07 08:43 . 2009-04-07 08:44 <DIR> d-------- c:\documents and settings\Administrator.KAMEL
2009-04-07 08:39 . 2009-04-07 08:39 <DIR> d-------- c:\documents and settings\Administrator
2009-04-07 04:57 . 2009-04-07 04:57 <DIR> d-------- c:\documents and settings\KAMEL66\Application Data\CyberScrub
2009-04-07 04:57 . 2009-04-07 04:57 <DIR> d-------- c:\documents and settings\KAMEL66\Application Data\cleaner
2009-04-06 20:43 . 2009-04-06 20:43 0 --a------ c:\windows\nsreg.dat
2009-04-06 17:28 . 2009-04-06 17:28 <DIR> d-------- c:\program files\GetSmile
2009-04-06 17:28 . 2009-04-06 17:28 <DIR> d-------- c:\documents and settings\KAMEL66\Application Data\Sofrayt
2009-04-06 16:04 . 2009-02-09 04:08 1,847,552 --------- c:\windows\system32\dllcache\win32k.sys
2009-04-06 16:04 . 2008-12-04 23:58 144,896 --------- c:\windows\system32\dllcache\schannel.dll
2009-04-06 15:54 . 2008-12-11 05:33 333,952 --------- c:\windows\system32\dllcache\srv.sys
2009-04-06 14:02 . 2009-04-06 14:02 203,776 --a------ c:\windows\system32\clrviddc.dll
2009-04-06 13:46 . 2009-04-06 13:46 <DIR> d-------- c:\documents and settings\KAMEL66\Application Data\Yahoo!
2009-04-06 13:45 . 2009-04-06 15:50 <DIR> d-------- c:\documents and settings\All Users\Application Data\Yahoo!
2009-04-06 13:44 . 2009-04-06 13:52 <DIR> d-------- c:\program files\Yahoo!
2009-04-06 13:37 . 2009-04-07 06:02 <DIR> d-------- c:\documents and settings\KAMEL66\Application Data\Skype
2009-04-06 13:36 . 2009-04-06 13:36 <DIR> dr------- c:\program files\Skype
2009-04-06 13:36 . 2009-04-06 13:36 <DIR> d-------- c:\documents and settings\All Users\Application Data\Skype
2009-04-06 13:31 . 2009-04-06 13:32 <DIR> d-------- c:\documents and settings\All Users\Application Data\DFX
2009-04-06 13:30 . 2009-04-06 13:31 <DIR> d-------- c:\program files\DFX
2009-04-06 13:30 . 2009-04-06 13:30 <DIR> d-------- c:\program files\Common Files\DFX
2009-04-06 13:22 . 2009-04-06 13:22 <DIR> d-------- c:\program files\Common Files\xing shared
2009-04-06 13:02 . 2008-09-16 12:23 168,448 --a------ c:\windows\system32\unrar.dll
2009-04-06 13:01 . 2009-04-06 13:02 <DIR> d-------- c:\program files\K-Lite Codec Pack
2009-04-06 13:01 . 2008-11-06 09:37 3,596,288 --a------ c:\windows\system32\qt-dx331.dll
2009-04-06 13:01 . 2008-09-24 11:41 839,680 --a------ c:\windows\system32\lameACM.acm
2009-04-06 13:01 . 2008-12-07 11:08 795,648 --a------ c:\windows\system32\xvidcore.dll
2009-04-06 13:01 . 2008-11-06 09:33 684,032 --a------ c:\windows\system32\divx.dll
2009-04-06 13:01 . 2004-01-25 09:18 217,088 --a------ c:\windows\system32\yv12vfw.dll
2009-04-06 13:01 . 2008-12-07 11:08 130,048 --a------ c:\windows\system32\xvidvfw.dll
2009-04-06 13:01 . 2007-09-20 17:52 118,784 --a------ c:\windows\system32\ac3acm.acm
2009-04-06 13:01 . 2008-12-10 17:33 86,016 --a------ c:\windows\system32\dpl100.dll
2009-04-06 13:01 . 2009-03-02 11:10 67,584 --a------ c:\windows\system32\ff_vfw.dll
2009-04-06 13:01 . 2007-07-10 09:10 547 --a------ c:\windows\system32\ff_vfw.dll.manifest
2009-04-06 13:01 . 2008-10-03 05:30 414 --a------ c:\windows\system32\lame_acm.xml
2009-04-06 12:59 . 2009-04-06 12:59 <DIR> d-------- c:\program files\Panicware
2009-04-06 12:52 . 2009-04-06 12:52 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2009-04-06 12:52 . 2009-04-06 12:51 686,858 --a------ c:\windows\unins000.exe
2009-04-06 12:52 . 2009-04-06 12:52 801 --a------ c:\windows\unins000.dat
2009-04-06 12:49 . 2009-04-06 12:49 <DIR> d-------- c:\program files\Real
2009-04-06 12:49 . 2009-04-06 13:22 <DIR> d-------- c:\program files\Common Files\Real
2009-04-06 12:45 . 2009-04-06 12:45 <DIR> d-------- c:\documents and settings\KAMEL66\Application Data\TuneUp Software
2009-04-06 12:45 . 2009-04-06 12:45 603,904 --a------ c:\windows\system32\TUProgSt.exe
2009-04-06 12:45 . 2009-04-06 12:45 360,192 --a------ c:\windows\system32\TuneUpDefragService.exe
2009-04-06 12:45 . 2008-12-11 13:31 27,904 --a------ c:\windows\system32\uxtuneup.dll
2009-04-06 12:44 . 2009-04-06 12:46 <DIR> d-------- c:\program files\TuneUp Utilities 2009
2009-04-06 12:44 . 2009-04-06 12:44 <DIR> d-------- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-04-06 12:44 . 2009-04-06 12:44 <DIR> d--hs---- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-04-06 12:42 . 2009-04-06 12:42 <DIR> d-------- c:\windows\system32\athan
2009-04-06 12:42 . 2009-04-06 12:43 <DIR> d-------- c:\program files\Athan
2009-04-06 12:42 . 2009-04-06 12:42 737,280 --a------ c:\windows\iun6002.exe
2009-04-06 12:35 . 2009-04-06 12:35 <DIR> d--hs---- c:\documents and settings\KAMEL66\IECompatCache
2009-04-06 12:34 . 2009-04-06 12:34 <DIR> d--hs---- c:\documents and settings\KAMEL66\PrivacIE
2009-04-06 12:32 . 2009-04-06 12:32 <DIR> d--hs---- c:\documents and settings\KAMEL66\IETldCache
2009-04-06 12:18 . 2009-04-06 12:18 <DIR> d-------- c:\windows\ie8updates
2009-04-06 12:12 . 2009-04-06 12:12 <DIR> d-------- c:\program files\Babylon
2009-04-06 12:12 . 2009-01-07 18:21 26,144 --a------ c:\windows\system32\spupdsvc.exe
2009-04-06 12:11 . 2009-04-06 14:12 <DIR> d-------- c:\documents and settings\KAMEL66\Application Data\Babylon
2009-04-06 12:11 . 2009-04-08 20:59 <DIR> d-------- c:\documents and settings\All Users\Application Data\Babylon
2009-04-06 12:10 . 2009-04-06 12:14 <DIR> d--h-c--- c:\windows\ie8
2009-04-06 12:07 . 2009-04-06 12:07 552 --a------ c:\windows\system32\d3d8caps.dat
2009-04-06 12:05 . 2009-02-27 21:55 105,984 --------- c:\windows\system32\dllcache\iecompat.dll
2009-04-06 12:03 . 2009-04-08 15:52 <DIR> d-------- c:\documents and settings\KAMEL66\Application Data\Thinstall
2009-04-06 12:03 . 2009-04-06 12:03 <DIR> d-------- c:\documents and settings\KAMEL66\Application Data\Media Player Classic
2009-04-06 12:00 . 2009-04-06 12:02 <DIR> d--h----- c:\windows\NiwradSoft Shell Pack
2009-04-06 12:00 . 2009-01-08 13:12 218,624 --a------ c:\windows\system32\uxtheme.dll.backup
2009-04-06 11:58 . 2009-04-06 11:58 <DIR> d-------- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-04-06 11:47 . 2009-04-06 11:48 <DIR> d-------- c:\program files\QuickTime
2009-04-06 11:47 . 2009-04-06 11:47 <DIR> d-------- c:\program files\Apple Software Update
2009-04-06 11:47 . 2009-04-06 11:47 <DIR> d-------- c:\documents and settings\All Users\Application Data\Apple Computer
2009-04-06 11:47 . 2009-04-06 11:47 <DIR> d-------- c:\documents and settings\All Users\Application Data\Apple
2009-04-06 11:38 . 2009-04-06 11:38 <DIR> d-------- C:\unzipped
2009-04-06 11:29 . 2009-04-06 11:29 <DIR> d-------- c:\documents and settings\KAMEL66\Application Data\DriverCure
2009-04-06 11:28 . 2009-04-06 11:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\ParetoLogic
2009-04-06 11:28 . 2009-04-06 11:30 <DIR> d-------- c:\documents and settings\All Users\Application Data\DriverCure
2009-04-06 11:09 . 2009-04-06 11:36 <DIR> d-------- c:\program files\Internet Download Manager
2009-04-06 11:09 . 2009-04-06 11:32 <DIR> d-------- c:\documents and settings\KAMEL66\Application Data\IDM
2009-04-06 11:09 . 2009-04-09 13:14 <DIR> d-------- c:\documents and settings\KAMEL66\Application Data\DMCache
2009-04-06 11:02 . 2009-04-06 11:02 <DIR> d-------- c:\program files\Common Files\Adobe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-09 20:14 3,248 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-04-09 17:16 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-04-09 04:52 319,520 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-04-09 04:52 12,628 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-09 04:52 1,344,032 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-08 23:18 --------- d--h--w c:\program files\InstallShield Installation Information
2009-04-08 23:17 --------- d-----w c:\program files\Common Files\InstallShield
2009-04-06 19:49 499,712 ----a-w c:\windows\system32\msvcp71.dll
2009-04-06 19:00 218,624 ----a-w c:\windows\system32\uxtheme.dll
2009-04-06 18:12 89,601 ----a-w c:\windows\system32\drivers\klick.dat
2009-04-06 18:12 33,808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-04-06 18:12 101,287 ----a-w c:\windows\system32\drivers\klin.dat
2009-04-06 17:52 --------- d-----w c:\program files\Kaspersky Lab
2009-04-06 17:51 --------- d-----w c:\program files\Kaspersky Anti-Virus 2009
2009-04-06 17:48 --------- d-----w c:\program files\Microsoft.NET
2009-04-06 17:48 --------- d-----w c:\program files\Microsoft ActiveSync
2009-04-06 17:28 --------- d-----w c:\program files\OptusNet DSL Internet
2009-04-06 17:27 --------- d-----w c:\program files\Siemens Subscriber Networks
2009-04-06 17:11 --------- d-----w c:\program files\Windows Media Connect 2
2009-03-08 21:09 638,816 ----a-w c:\windows\system32\dllcache\iexplore.exe
2009-03-08 21:09 391,536 ----a-w c:\windows\system32\dllcache\iedkcs32.dll
2009-03-08 11:41 5,937,152 ----a-w c:\windows\system32\dllcache\mshtml.dll
2009-03-08 11:39 11,063,808 ----a-w c:\windows\system32\dllcache\ieframe.dll
2009-03-08 11:34 914,944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 11:34 914,944 ----a-w c:\windows\system32\dllcache\wininet.dll
2009-03-08 11:34 43,008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 11:34 43,008 ------w c:\windows\system32\dllcache\licmgr10.dll
2009-03-08 11:34 236,544 ----a-w c:\windows\system32\dllcache\webcheck.dll
2009-03-08 11:34 193,536 ----a-w c:\windows\system32\dllcache\msrating.dll
2009-03-08 11:34 109,568 ----a-w c:\windows\system32\dllcache\occache.dll
2009-03-08 11:34 105,984 ----a-w c:\windows\system32\dllcache\url.dll
2009-03-08 11:34 1,206,784 ----a-w c:\windows\system32\dllcache\urlmon.dll
2009-03-08 11:33 759,296 ----a-w c:\windows\system32\dllcache\VGX.dll
2009-03-08 11:33 726,528 ------w c:\windows\system32\dllcache\jscript.dll
2009-03-08 11:33 420,352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 11:33 420,352 ------w c:\windows\system32\dllcache\vbscript.dll
2009-03-08 11:33 25,600 ----a-w c:\windows\system32\dllcache\jsproxy.dll
2009-03-08 11:33 229,376 ----a-w c:\windows\system32\dllcache\ieaksie.dll
2009-03-08 11:33 18,944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 11:33 18,944 ------w c:\windows\system32\dllcache\corpol.dll
2009-03-08 11:33 125,952 ----a-w c:\windows\system32\dllcache\ieakeng.dll
2009-03-08 11:32 94,720 ------w c:\windows\system32\dllcache\inseng.dll
2009-03-08 11:32 72,704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 11:32 72,704 ------w c:\windows\system32\dllcache\admparse.dll
2009-03-08 11:32 71,680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 11:32 71,680 ------w c:\windows\system32\dllcache\iesetup.dll
2009-03-08 11:32 611,840 ----a-w c:\windows\system32\dllcache\mstime.dll
2009-03-08 11:32 594,432 ----a-w c:\windows\system32\dllcache\msfeeds.dll
2009-03-08 11:32 55,808 ----a-w c:\windows\system32\dllcache\iernonce.dll
2009-03-08 11:32 173,056 ----a-w c:\windows\system32\dllcache\ie4uinit.exe
2009-03-08 11:32 163,840 ----a-w c:\windows\system32\dllcache\ieakui.dll
2009-03-08 11:32 128,512 ----a-w c:\windows\system32\dllcache\advpack.dll
2009-03-08 11:32 1,985,024 ----a-w c:\windows\system32\dllcache\iertutil.dll
2009-03-08 11:24 68,608 ------w c:\windows\system32\dllcache\hmmapi.dll
2009-03-08 11:22 156,160 ----a-w c:\windows\system32\msls31.dll
2009-03-08 11:22 156,160 ------w c:\windows\system32\dllcache\msls31.dll
2009-03-08 11:11 445,952 ----a-w c:\windows\system32\dllcache\ieapfltr.dll
2009-02-09 11:08 1,847,552 ----a-w c:\windows\system32\win32k.sys
.
------- Sigcheck -------
2009-01-08 13:12 361600 5ae1c2695f6523ad98b948f2887d8c5e c:\windows\system32\drivers\tcpip.sys
2009-01-08 12:41 2066048 a25e9b86effb2af33bf51e676b68bfb0 c:\windows\NiwradSoft Shell Pack\Backup\ntkrnlpa.exe
2009-01-08 12:41 2228608 e251c3a2d35291517c4e475a7895b87d c:\windows\system32\ntkrnlpa.exe
2009-01-08 12:10 2189184 31914172342bff330063f343ac6958fe c:\windows\NiwradSoft Shell Pack\Backup\ntoskrnl.exe
2009-01-08 12:10 2351744 11b410392f3ca0535e0319efcf326f9a c:\windows\system32\ntoskrnl.exe
2009-01-08 12:07 1540608 a6b357bf2cdb93808fd7372abc75625e c:\windows\explorer.exe
2009-01-08 12:07 1033728 2bb75b7f548d82a099125d0c5971de7d c:\windows\NiwradSoft Shell Pack\Backup\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PopUpStopperFreeEdition"="c:\progra~1\PANICW~1\POP-UP~1\PSFree.exe" [2005-03-17 536576]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2008-05-13 2594224]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Desktop Service Centre"="c:\program files\OptusNet DSL Internet\DSC.exe" [2005-11-29 2919831]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-04-06 206088]
"Athan"="c:\program files\Athan\Athan.exe" [2009-01-18 1081344]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-06 198160]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"IDMan"=; c:\program files\Internet Download Manager\IDMan.exe /onboot
"Messenger (Yahoo!)"=; "c:\program files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
"Skype"=; "c:\program files\Skype\Phone\Skype.exe" /nosplash /minimized
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Babylon Client"=; c:\program files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
"QuickTime Task"=; "c:\program files\QuickTime\qttask.exe" -atboottime
"SoundMan"=; SOUNDMAN.EXE
"SpyHunter Security Suite"=; c:\program files\Enigma Software Group\SpyHunter\SpyHunter3.exe
"TkBellExe"=; "c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-04-30 24592]
S2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [2009-04-06 603904]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-04-09 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 21:36]
2009-04-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
2009-04-08 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe []
2009-04-09 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe []
2009-04-09 c:\windows\Tasks\User_Feed_Synchronization-{6CFB0BBE-E7AE-4FCD-B195-083628D3C52A}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 04:31]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
mStart Page = about:blank
IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Translate with &Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
FF - ProfilePath - c:\documents and settings\KAMEL66\Application Data\Mozilla\Firefox\Profiles\vtx4ukzi.default\
FF - component: c:\documents and settings\KAMEL66\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-09 13:14:18
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(936)
c:\windows\system32\SETUPAPI.dll
- - - - - - - > 'lsass.exe'(992)
c:\windows\system32\SETUPAPI.dll
.
Completion time: 2009-04-09 13:17:16
ComboFix-quarantined-files.txt 2009-04-09 20:17:11
Pre-Run: 14,049,562,624 bytes free
Post-Run: 14,075,944,960 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
273 --- E O F --- 2009-04-08 22:54:28
