ComboFix 09-04-04.01 - Administrator 04/10/2009 23:23:07.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1025.18.502.218 [GMT 3:00]
Running from: c:\documents and settings\Administrator\سطح المكتب\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated)
FW: Kaspersky Anti-Virus *disabled*
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Autorun.inf
c:\docume~1\ADMINI~1\LOCALS~1\adhvvf.kor
c:\windows\IE4 Error Log.txt
c:\windows\system32\agsaame.dll
c:\windows\system32\ALOAudioFile2.dll
c:\windows\system32\ALOAVIFile.dll
c:\windows\system32\ALOQuickTimeFile.dll
c:\windows\system32\ALOVideoCoreM.dll
c:\windows\system32\ALOWMAFile2.dll
c:\windows\system32\Desktop_.ini
c:\windows\system32\kakle.dll
c:\windows\system32\setting.ini
c:\windows\system32\videocore.dll
c:\windows\system32\videoformat.dll
c:\windows\system32\winitn.dll
D:\Autorun.inf
E:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2009-03-10 to 2009-04-10 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-10 20:27 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-04-10 20:26 4,492 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-04-10 20:26 385,056 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-04-10 20:26 16,448 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-10 20:26 1,698,848 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-10 14:33 --------- d-----w c:\program files\WIDCOMM
2009-04-10 14:03 --------- d-----w c:\documents and settings\Administrator\Application Data\U3
2009-04-10 09:55 --------- d-----w c:\program files\AV VCS 3.0
2009-04-10 07:35 --------- d-----w c:\program files\Hotspot Shield
2009-04-08 23:07 --------- d-----w c:\program files\Mobile Partner
2009-04-08 21:47 --------- d--h--w c:\program files\InstallShield Installation Information
2009-04-08 12:31 --------- d-----w c:\documents and settings\Administrator\Application Data\oovootb
2009-04-08 12:19 --------- d-----w c:\program files\Hotspot_Shield
2009-04-08 12:18 --------- d-----w c:\program files\Conduit
2009-04-05 06:39 33,808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-04-04 19:57 --------- d-----w c:\program files\oovootb
2009-04-04 19:56 --------- d-----w c:\program files\mpegable
2009-04-04 19:56 --------- d-----w c:\program files\ClocX
2009-04-04 19:56 --------- d-----w c:\program files\Atheros
2009-04-04 19:48 72,226 ----a-w c:\windows\BricoPackUninst.cmd
2009-04-04 19:23 89,601 ----a-w c:\windows\system32\drivers\klick.dat
2009-04-04 19:23 101,287 ----a-w c:\windows\system32\drivers\klin.dat
2009-04-04 18:46 --------- d-----w c:\program files\Kaspersky Lab
2009-04-04 14:20 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-04-04 11:49 --------- d-----w c:\documents and settings\Administrator\Application Data\dead grid bind
2009-04-03 18:18 33,256 ----a-w c:\windows\system32\drivers\hssdrv.sys
2009-04-03 13:40 --------- d-----w c:\program files\Google
2009-04-03 10:51 --------- d-----w c:\program files\Professor Franklin
2009-04-03 10:51 --------- d-----w c:\program files\Common Files\Streetwise Shared
2009-04-03 08:27 --------- d-----w c:\program files\DFX
2009-04-03 08:27 --------- d-----w c:\documents and settings\All Users\Application Data\DFX
2009-04-03 08:26 --------- d-----w c:\program files\Common Files\DFX
2009-04-02 10:38 41,581 ----a-w C:\report.zip
2009-04-01 19:56 --------- d-----w c:\program files\Circl Developement
2009-04-01 14:12 --------- d-----w c:\program files\Ozone
2009-03-31 13:05 --------- d-----w c:\documents and settings\Administrator\Application Data\Webcammax
2009-03-31 12:04 --------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-03-30 22:02 --------- d-----w c:\documents and settings\Administrator\Application Data\EmailNotifier
2009-03-30 20:58 --------- d-----w c:\documents and settings\Administrator\Application Data\ooVoo Details
2009-03-30 20:53 --------- d-----w c:\program files\ooVoo
2009-03-30 20:52 --------- d-----w c:\documents and settings\All Users\Application Data\EmailNotifier
2009-03-29 01:47 --------- d-----w c:\program files\SodaBush
2009-03-29 01:47 --------- d-----w c:\documents and settings\Administrator\Application Data\SodaBush
2009-03-29 00:48 --------- d-----w c:\program files\Perfect Uninstaller
2009-03-28 12:05 --------- d-----w c:\program files\AVG
2009-03-28 11:47 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-03-28 04:30 --------- d-----w c:\program files\Windows Live Safety Center
2009-03-27 17:30 --------- d-----w c:\program files\Disk Password Protection
2009-03-27 16:09 --------- d-----w c:\program files\LtUcx
2009-03-26 21:44 --------- d-----w c:\program files\Common Files\ACD Systems
2009-03-26 02:35 --------- d-----w c:\program files\GreenBrowser
2009-03-25 18:25 --------- d-----w c:\documents and settings\Administrator\Application Data\Media Player Classic
2009-03-25 10:37 --------- d-----w c:\program files\Common Files\xing shared
2009-03-25 10:37 --------- d-----w c:\program files\Common Files\Real
2009-03-25 09:12 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-03-25 09:04 --------- d-----w c:\program files\dead grid bind
2009-03-25 09:04 --------- d-----w c:\documents and settings\All Users\Application Data\Okay Way Sixth Exit
2009-03-25 09:03 --------- d-----w c:\program files\Messenger Plus! Live
2009-03-25 09:00 --------- d-----w c:\program files\Windows Live
2009-03-25 08:59 --------- d-----w c:\program files\Windows Live SkyDrive
2009-03-25 08:59 --------- d-----w c:\program files\Microsoft
2009-03-25 08:33 --------- d-----w c:\program files\Common Files\Windows Live
2009-03-25 08:06 --------- d-----w c:\program files\Webteh
2009-03-25 08:06 --------- d-----w c:\documents and settings\Administrator\Application Data\BSplayer Pro
2009-03-25 06:43 --------- d-----w c:\program files\Microsoft.NET
2009-03-25 06:42 --------- d-----w c:\program files\Microsoft Works
2009-03-24 20:32 --------- d-----w c:\program files\Common Files\Adobe
2009-03-24 20:30 --------- d-----w c:\documents and settings\All Users\Application Data\WinZip
2009-03-24 20:27 --------- d-----w c:\program files\Common Files\Ahead
2009-03-24 20:27 --------- d-----w c:\program files\Ahead
2009-03-24 20:24 --------- d-----w c:\program files\Real
2009-03-24 20:23 47,104 ------w c:\windows\AKDeInstall.exe
2009-03-24 20:22 --------- d-----w c:\program files\K-Lite Codec Pack
2009-03-24 20:21 720,896 ----a-w c:\windows\iun6002.exe
2009-03-24 20:20 --------- d-----w c:\program files\FLV Player
2009-03-24 20:19 --------- d-----w c:\program files\Yahoo!
2009-03-24 20:18 --------- d-----w c:\program files\QuickTime
2009-03-24 20:17 --------- d-----w c:\program files\Apple Software Update
2009-03-24 20:17 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2009-03-24 20:17 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-03-24 20:16 --------- d-----w c:\program files\CyberLink
2009-03-24 20:13 10,368 ----a-w c:\windows\system32\drivers\pfc.sys
2009-03-24 20:13 --------- d-----w c:\documents and settings\Administrator\Application Data\ACD Systems
2009-03-24 20:12 --------- d-----w c:\program files\Xilisoft
2009-03-24 20:11 --------- d-----w c:\program files\Java
2009-03-24 20:10 --------- d-----w c:\program files\Common Files\Java
2009-03-24 19:51 --------- d-----w c:\program files\Synaptics
2009-03-24 19:51 --------- d-----w c:\program files\Common Files\InstallShield
2009-03-24 19:47 --------- d-----w c:\program files\Fingerprint Sensor
2009-03-24 19:41 --------- d-----w c:\documents and settings\All Users\Application Data\Atheros
2009-03-24 19:41 --------- d-----w c:\documents and settings\Administrator\Application Data\InstallShield
2009-03-24 19:39 --------- d-----w c:\program files\Broadcom
2009-03-24 19:36 --------- d-----w c:\program files\CONEXANT
2009-03-24 19:24 315,392 ----a-w c:\windows\HideWin.exe
2009-03-24 19:24 --------- d-----w c:\program files\Realtek
2009-03-24 19:15 --------- d-----w c:\program files\Intel
2009-03-24 18:47 --------- d-----w c:\program files\microsoft frontpage
.
------- Sigcheck -------
04/14/2008 09:29 PM 974848 5320ea6507cfa8abc92caf91cd2fc8a5 c:\windows\explorer.exe
08/03/2004 11:56 PM 973312 a10b8a9309fee2bf9ee6538693844d77 c:\windows\$NtServicePackUninstall$\explorer.exe
04/14/2008 09:29 PM 974848 5320ea6507cfa8abc92caf91cd2fc8a5 c:\windows\ServicePackFiles\i386\explorer.exe
08/03/2004 11:56 PM 100352 fe6583e05057a70b96d83038544b22cd c:\windows\$NtServicePackUninstall$\wuauclt.exe
04/14/2008 09:30 PM 100352 70d82b81c0157cf4579b1ada9a9551b0 c:\windows\ServicePackFiles\i386\wuauclt.exe
04/14/2008 09:30 PM 100352 70d82b81c0157cf4579b1ada9a9551b0 c:\windows\system32\wuauclt.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "c:\program files\Hotspot_Shield\tbHots.dll" [06/24/2008 11:17 PM 1569304]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A1FB2F9A-D35E-11DD-8935-E46A56D89593}]
03/16/2009 04:53 PM 87512 --a------ c:\program files\oovootb\dtx.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
06/24/2008 11:17 PM 1569304 --a------ c:\program files\Hotspot_Shield\tbHots.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
04/08/2009 03:18 PM 204248 --a------ c:\program files\Hotspot Shield\hssie\HssIE.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A1FB2F9A-D35E-11DD-8935-E46A56D89593}"= "c:\program files\oovootb\dtx.dll" [03/16/2009 04:53 PM 87512]
"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "c:\program files\Hotspot_Shield\tbHots.dll" [06/24/2008 11:17 PM 1569304]
[HKEY_CLASSES_ROOT\clsid\{a1fb2f9a-d35e-11dd-8935-e46a56d89593}]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}"= "c:\program files\Hotspot_Shield\tbHots.dll" [06/24/2008 11:17 PM 1569304]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"oovoo.exe"="c:\program files\ooVoo\oovoo.exe" [02/25/2009 06:29 PM 14657328]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [04/14/2008 09:29 PM 15360]
"ClocX"="c:\program files\ClocX\ClocX.exe" [07/26/2007 06:43 PM 270336]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [03/25/2009 01:37 PM 198160]
"Sixth exit vga dash"="c:\documents and settings\All Users\Application Data\Okay Way Sixth Exit\meow corn.exe" [04/10/2009 11:27 PM 765952]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [07/09/2001 11:50 AM 155648]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [09/01/2006 03:57 PM 282624]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [12/05/2006 10:55 PM 54832]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [12/06/2006 06:37 PM 69216]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [11/10/2005 01:03 PM 36975]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [05/19/2006 02:51 PM 774233]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [06/11/2005 02:51 PM 53248]
"Persistence"="c:\windows\system32\igfxpers.exe" [06/13/2007 07:55 AM 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [06/13/2007 07:55 AM 162584]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [06/13/2007 07:56 AM 142104]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [04/04/2009 10:23 PM 206088]
"ClocX"="c:\program files\ClocX\ClocX.exe" [07/26/2007 06:43 PM 270336]
"RTHDCPL"="RTHDCPL.EXE" [05/28/2007 11:32 AM 16132608 c:\windows\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [04/14/2008 09:29 PM 15360]
c:\documents and settings\Administrator\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 630784]
TransBar.lnk - c:\windows\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 65536]
UberIcon.lnk - c:\windows\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 180224]
Y'z Shadow.lnk - c:\windows\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 155648]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-04-01 568176]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:TCP"= 443:TCP
oVoo TCP المنفذ 443
"443:UDP"= 443:UDP
oVoo UDP المنفذ 443
"37674:TCP"= 37674:TCP
oVoo TCP المنفذ 37674
"37674:UDP"= 37674:UDP
oVoo UDP المنفذ 37674
"37675:UDP"= 37675:UDP
oVoo UDP المنفذ 37675
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808]
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};c:\program files\CyberLink\PowerDVD\
000.fcl [2009-03-24 23:16:17 13560]
R2 HssSrv;Hotspot Shield Helper Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [2009-04-03 364008]
R3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\system32\drivers\hssdrv.sys [2009-04-08 33256]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-04-30 24592]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{81a872ae-1916-11de-a4cb-001fe2eb8fc8}]
\Shell\AutoRun\command - d1vmq.exe
\Shell\open\Command - d1vmq.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e8bca3a0-2482-11de-ae18-0017c4233d07}]
\Shell\AutoRun\command - G:\AutoRun.exe
.
Contents of the 'Scheduled Tasks' folder
2009-04-10 c:\windows\Tasks\AB67912C91BC0448.job
- c:\docume~1\admini~1\applic~1\deadgr~1\Logo team name.exe [03/25/2009 12:05 PM]
2009-04-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [08/29/2006 02:21 PM]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-curb style - c:\docume~1\ADMINI~1\APPLIC~1\DEADGR~1\OwnsDoes.exe
Notify-avgrsstarter - avgrsstx.dll
Notify-WgaLogon - (no file)
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: Microsoft XML Parser for Java -
DPF: {20AD521D-3A3E-11D4-BC32-0050040D952B} -
DPF: {C171FF59-8C55-4796-A398-4F5D02B4C763} - hxxp://76.76.19.77/imscp/talks3n.cab
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-10 23:27:48
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\
000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1202660629-329068152-725345543-500\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{B59DF565-52D0-FDA2-4C4A-103AAE382F7A}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"ialjpnfbiphhikjhlc"=hex:6b,61,6b,6f,6b,6a,70,70,6d,62,6b,6a,63,6f,69,6f,67,6f,
68,6c,65,64,00,00
"jalafjmpleaonihblmcd"=hex:62,61,6e,6e,00,00
"jalafjmpleaonihblmgd"=hex:62,61,62,6f,00,00
"hafknagdfpeacaog"=hex:6b,61,6b,6f,6b,6a,70,70,6d,62,6b,6a,63,6f,69,6f,67,6f,
68,6c,65,64,00,00
"iafknaldhmiidoobnh"=hex:6e,61,6b,6a,64,63,6c,66,66,66,67,6a,6c,6c,6f,67,69,63,
62,64,6a,68,6a,65,6b,6d,6f,6b,00,d0
"hahabmbofplmgbcl"=hex:70,61,6d,61,65,6a,70,61,69,6e,63,64,70,61,6f,62,69,62,
66,67,62,6c,65,69,70,63,70,67,66,66,6e,6a,00,05
"jaiaembkgcfknbpdhgkp"=hex:64,62,68,6f,62,66,70,66,64,70,6b,6e,6d,64,6d,6e,6e,
66,69,6d,68,61,6f,6e,67,62,68,66,66,6a,6f,6c,63,63,62,6d,62,70,62,6b,00,05
"jagkiagflmdcaklfgbhp"=hex:62,61,6a,6f,00,00
"babk"=hex:64,61,6b,6f,67,6a,61,62,00,ee
"back"=hex:63,61,6c,6f,67,67,00,62
"cailjf"=hex:64,61,63,6f,69,64,67,70,00,ee
"cailif"=hex:64,61,6c,6f,68,67,66,68,00,ee
"iaikcoeffoicfbhmmf"=hex:65,61,6b,6f,6b,6a,61,61,66,70,00,00
"iaikcoeffoicfbhmpf"=hex:64,61,6d,6f,70,66,6f,62,00,70
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B59DF565-52D0-FDA2-4C4A-103AAE382F7A}\InProcServer32*]
"jajjjdcpdbehnhdjbemh"=hex:67,61,62,6f,70,66,6e,63,6a,6b,6a,65,62,6a,00,00
.
------------------------ Other Running Processes ------------------------
.
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Internet Explorer\iexplore.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Hotspot Shield\bin\openvpnas.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\docume~1\ADMINI~1\LOCALS~1\Temp\RtkBtMnt.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 04/10/2009 23:29:38 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-10 20:29:34
Pre-Run: 22,332,416,000 bytes free
Post-Run: 22,772,506,624 bytes free
302
