طيب يا ابو ريما هذا التقرير :
ComboFix 09-04-13.A2 - user 04/13/2009 15:54.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1256.1.1025.18.764.161 [GMT 3:00]
Running from: c:\users\user\Searches\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
E:\autorun.inf
.
((((((((((((((((((((((((( Files Created from 2009-03-13 to 2009-04-13 )))))))))))))))))))))))))))))))
.
2009-04-13 12:51 . 2009-04-13 12:50 318976 ----a-w c:\windows\system32\CF7128.exe
2009-04-13 12:50 . 2009-04-13 12:51 -------- d-----w C:\32788R22FWJFW.0.tmp
2009-04-11 00:56 . 2008-12-16 05:31 7680 ----a-w c:\windows\system32\spwmp.dll
2009-04-11 00:56 . 2008-12-16 05:31 4096 ----a-w c:\windows\system32\msdxm.ocx
2009-04-11 00:56 . 2008-12-16 05:31 4096 ----a-w c:\windows\system32\dxmasf.dll
2009-04-11 00:56 . 2008-12-16 03:29 8147456 ----a-w c:\windows\system32\wmploc.DLL
2009-04-11 00:55 . 2009-02-09 03:10 2033152 ----a-w c:\windows\system32\win32k.sys
2009-04-11 00:55 . 2008-11-27 04:43 268288 ----a-w c:\windows\system32\schannel.dll
2009-03-29 23:39 . 2009-03-29 23:40 -------- d-----w c:\users\user\مجلد جديد
2009-03-29 18:03 . 2005-01-04 00:43 4682 ----a-w c:\windows\system32\npptNT2.sys
2009-03-29 18:03 . 2003-07-20 09:17 5174 ----a-w c:\windows\system32\nppt9x.vxd
2009-03-28 17:56 . 2008-10-10 01:52 452440 ----a-w c:\windows\system32\d3dx10_40.dll
2009-03-28 17:56 . 2008-10-10 01:52 2036576 ----a-w c:\windows\system32\D3DCompiler_40.dll
2009-03-28 17:56 . 2008-10-10 01:52 4379984 ----a-w c:\windows\system32\D3DX9_40.dll
2009-03-28 17:56 . 2008-10-27 07:04 514384 ----a-w c:\windows\system32\XAudio2_3.dll
2009-03-28 17:56 . 2008-10-27 07:04 70992 ----a-w c:\windows\system32\XAPOFX1_2.dll
2009-03-28 17:56 . 2008-10-27 07:04 235856 ----a-w c:\windows\system32\xactengine3_3.dll
2009-03-28 17:56 . 2008-10-27 07:04 23376 ----a-w c:\windows\system32\X3DAudio1_5.dll
2009-03-28 17:56 . 2008-07-30 03:20 68616 ----a-w c:\windows\system32\XAPOFX1_1.dll
2009-03-28 17:56 . 2008-07-30 03:20 509448 ----a-w c:\windows\system32\XAudio2_2.dll
2009-03-28 17:56 . 2008-07-30 03:20 238088 ----a-w c:\windows\system32\xactengine3_2.dll
2009-03-28 17:56 . 2008-07-10 08:01 467984 ----a-w c:\windows\system32\d3dx10_39.dll
2009-03-28 17:56 . 2008-07-10 08:00 1493528 ----a-w c:\windows\system32\D3DCompiler_39.dll
2009-03-28 17:54 . 2005-05-26 12:34 2297552 ----a-w c:\windows\system32\d3dx9_26.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-13 13:01 . 2008-11-03 10:52 -------- d-----w c:\users\user\AppData\Roaming\DMCache
2009-04-13 12:55 . 2008-11-27 21:44 23222560 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-13 12:55 . 2008-11-27 21:44 23222560 --sha-w c:\windows\System32\drivers\fidbox.dat
2009-04-13 12:51 . 2008-10-28 17:47 16384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
2009-04-13 12:51 . 2008-10-28 17:47 16384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2009-04-13 12:51 . 2008-10-28 17:47 32768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2009-04-13 12:31 . 2008-11-04 07:40 -------- d-----w c:\programdata\Kaspersky Lab
2009-04-13 12:09 . 2008-11-27 21:44 311492 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-13 12:08 . 2008-10-28 17:42 10724 ----a-w c:\windows\bthservsdp.dat
2009-04-13 11:46 . 2008-01-21 05:33 78446 ----a-w c:\windows\System32\perfc001.dat
2009-04-13 11:46 . 2008-01-21 05:33 439186 ----a-w c:\windows\System32\perfh001.dat
2009-04-13 11:21 . 2006-11-02 10:25 86016 ----a-w c:\windows\Inf\infstor.dat
2009-04-13 11:21 . 2006-11-02 10:25 51200 ----a-w c:\windows\Inf\infpub.dat
2009-04-13 11:21 . 2006-11-02 10:25 143360 ----a-w c:\windows\Inf\infstrng.dat
2009-04-13 11:17 . 2009-04-13 11:17 -------- d-----w c:\program files\BandRich
2009-04-13 08:31 . 2008-10-28 18:31 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-12 17:36 . 2009-04-12 17:36 -------- d-----w c:\program files\CCleaner
2009-04-12 05:41 . 2008-11-06 15:13 -------- d-----w c:\program files\Paltalk Messenger
2009-04-12 05:41 . 2008-11-06 15:13 -------- d-----w c:\users\user\AppData\Roaming\Paltalk
2009-04-11 06:01 . 2009-04-11 06:01 -------- d-----w c:\program files\LSI SoftModem
2009-04-11 04:52 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail
2009-04-10 01:36 . 2009-04-10 01:36 -------- d-----w c:\program files\iVocalize Web Conference 4
2009-04-09 19:12 . 2008-11-05 16:08 -------- d-----w c:\users\user\AppData\Roaming\Nokia
2009-04-01 23:24 . 2008-11-02 08:39 -------- d-----w c:\programdata\loud defy surf
2009-03-29 18:03 . 2009-03-29 18:03 -------- d-----w c:\program files\Common Files\INCA Shared
2009-03-29 17:52 . 2009-03-29 17:52 -------- d-----w c:\program files\Game Power 7
2009-03-12 03:37 . 2009-03-12 03:37 -------- d-----w c:\users\user\AppData\Roaming\Media Player Classic
2009-03-12 03:35 . 2009-03-12 03:35 -------- d-----w c:\programdata\Apple Computer
2009-03-12 03:34 . 2009-03-12 03:34 -------- d-----w c:\program files\K-Lite Codec Pack
2009-03-12 03:32 . 2008-11-02 07:02 -------- d-----w c:\program files\Real
2009-03-12 03:32 . 2008-11-02 07:02 -------- d-----w c:\program files\Common Files\Real
2009-03-09 13:04 . 2008-11-05 16:08 -------- d-----w c:\users\user\AppData\Roaming\PC Suite
2009-03-02 00:17 . 2009-02-11 09:57 -------- d-----w c:\programdata\DriverCure
2009-02-28 04:00 . 2008-11-02 08:39 -------- d-----w c:\program files\Circle Developement
2009-02-28 02:17 . 2008-12-18 23:44 -------- d-----w c:\program files\ALJAWAL 3.5G HSDPA DATA CARD
2009-02-28 02:16 . 2008-11-02 08:40 -------- d-----w c:\programdata\Shim pile start hide
2009-02-28 02:16 . 2009-02-11 09:57 -------- d-----w c:\program files\ParetoLogic
2009-02-28 02:16 . 2008-12-29 14:10 -------- d-----w c:\program files\Bytescribe
2009-02-28 02:16 . 2008-11-19 12:06 -------- d-----w c:\program files\Macromedia
2009-02-28 02:16 . 2008-10-28 18:31 -------- d-----w c:\program files\Broadcom
2009-02-27 01:35 . 2009-02-27 00:12 -------- d-----w c:\programdata\Yahoo!
2009-02-27 00:23 . 2008-12-14 03:12 -------- d-----w c:\users\user\AppData\Roaming\IDM
2009-02-21 03:34 . 2008-11-02 08:39 -------- d-----w c:\program files\Messenger Plus! Live
2009-02-06 15:52 . 2009-02-06 15:52 49504 ----a-w c:\windows\System32\sirenacm.dll
2009-01-15 06:11 . 2009-02-18 19:47 827392 ----a-w c:\windows\System32\wininet.dll
2008-12-31 15:03 . 2008-12-31 15:03 87552 ----a-w c:\users\user\AppData\Local\bootinst.exe
2008-11-04 12:11 . 2008-10-28 17:48 78440 ----a-w c:\users\user\AppData\Local\GDIPFONTCACHEV1.DAT
2008-10-28 18:25 . 2008-10-28 17:48 680 ----a-w c:\users\user\AppData\Local\d3d9caps.dat
2008-01-21 02:57 . 2006-11-02 12:48 174 --sha-w c:\program files\desktop.ini
2008-01-21 02:33 . 2008-01-21 02:33 165165 --sha-r c:\users\user\AppData\Roaming\aesbbi.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [12/14/2008 06:16 AM 2606512]
"ares"="c:\program files\Ares\Ares.exe" [08/21/2008 06:45 PM 888832]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [01/21/2008 05:35 AM 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [01/21/2008 12:17 PM 61440]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [04/15/2008 02:51 PM 488752]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [04/04/2008 03:10 PM 1314816]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [03/28/2008 02:05 AM 1045800]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-01-23 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~2.0\r3hook.dll c:\progra~1\KASPER~1\KASPER~2.0\adialhk.dll
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PalTalk.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\PalTalk.lnk
backup=c:\windows\pss\PalTalk.lnk.CommonStartup
backupExtension=.CommonStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
--a------ 08/21/2008 06:45 PM 888832 c:\program files\Ares\Ares.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 02/06/2009 06:53 PM 3885408 c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
--a------ 10/02/2008 07:00 AM 1124352 c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{BFD5278D-8E9B-4B73-A8D2-4913F11B5A69}c:\\users\\user\\appdata\\local\\temp\\rar$ex00.282\\ip_stealer\\ip_stealer\\ip stealer.exe"= UDP:c:\users\user\appdata\local\temp\rar$ex00.282\ip_stealer\ip_stealer\ip stealer.exe:ip stealer.exe
"UDP Query User{836D248D-ED7C-430A-AA90-D342AEB19C3A}c:\\users\\user\\appdata\\local\\temp\\rar$ex00.282\\ip_stealer\\ip_stealer\\ip stealer.exe"= TCP:c:\users\user\appdata\local\temp\rar$ex00.282\ip_stealer\ip_stealer\ip stealer.exe:ip stealer.exe
"TCP Query User{03D03CDC-7D88-4972-B217-2B4EDA8CFF03}c:\\users\\user\\appdata\\local\\temp\\rar$ex22.430\\ip_stealer\\ip_stealer\\ip stealer.exe"= UDP:c:\users\user\appdata\local\temp\rar$ex22.430\ip_stealer\ip_stealer\ip stealer.exe:ip stealer.exe
"UDP Query User{D6AA62FB-3EB6-4336-855C-65773F0F183F}c:\\users\\user\\appdata\\local\\temp\\rar$ex22.430\\ip_stealer\\ip_stealer\\ip stealer.exe"= TCP:c:\users\user\appdata\local\temp\rar$ex22.430\ip_stealer\ip_stealer\ip stealer.exe:ip stealer.exe
"TCP Query User{4F0CA5CA-761A-4E89-90B7-0026585F8E41}c:\\users\\user\\appdata\\local\\temp\\rar$ex47.021\\ip_stealer\\ip_stealer\\ip stealer.exe"= UDP:c:\users\user\appdata\local\temp\rar$ex47.021\ip_stealer\ip_stealer\ip stealer.exe:ip stealer.exe
"UDP Query User{442CA0FA-CFAD-4A10-8C7A-8503116000B0}c:\\users\\user\\appdata\\local\\temp\\rar$ex47.021\\ip_stealer\\ip_stealer\\ip stealer.exe"= TCP:c:\users\user\appdata\local\temp\rar$ex47.021\ip_stealer\ip_stealer\ip stealer.exe:ip stealer.exe
"TCP Query User{D2967807-992C-4C64-BDBA-DD102DFCCC6F}c:\\program files\\ares\\ares.exe"= UDP:c:\program files\ares\ares.exe:Ares p2p for windows
"UDP Query User{7F128039-54BD-463F-A5A0-08616B3BFD2E}c:\\program files\\ares\\ares.exe"= TCP:c:\program files\ares\ares.exe:Ares p2p for windows
"TCP Query User{201C154B-2119-4473-8192-8D98EFAF901F}c:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= UDP:c:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
"UDP Query User{D652CBBF-7ACC-443B-A280-B305386FAFCA}c:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= TCP:c:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
"TCP Query User{03401FF3-2653-4643-ADD6-436D60E8405D}c:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= UDP:c:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"UDP Query User{F7E1FFAF-F2C7-466F-AEAE-79CA80E810D7}c:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= TCP:c:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"TCP Query User{CB22634E-F0F4-4363-AECF-B05BE8524FEA}c:\\program files\\ares\\ares.exe"= UDP:c:\program files\ares\ares.exe:Ares p2p for windows
"UDP Query User{0D58D4B7-87C7-402A-A546-90732068AA9C}c:\\program files\\ares\\ares.exe"= TCP:c:\program files\ares\ares.exe:Ares p2p for windows
"TCP Query User{B2BF41B5-F03E-4951-9DAB-50E443BFEF82}c:\\users\\user\\appdata\\local\\temp\\rar$ex12.5559\\ip_stealer\\ip_stealer\\ip stealer.exe"= UDP:c:\users\user\appdata\local\temp\rar$ex12.5559\ip_stealer\ip_stealer\ip stealer.exe:ip stealer.exe
"UDP Query User{FD3A2797-A6B8-4667-B79E-BC50C8A1D5BA}c:\\users\\user\\appdata\\local\\temp\\rar$ex12.5559\\ip_stealer\\ip_stealer\\ip stealer.exe"= TCP:c:\users\user\appdata\local\temp\rar$ex12.5559\ip_stealer\ip_stealer\ip stealer.exe:ip stealer.exe
R3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB; [x]
R3 dump_wmimmc;dump_wmimmc; [x]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [02/01/2008 03:17 PM 138112]
R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [02/01/2008 03:17 PM 8320]
R3 RTL8187;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187.sys [01/30/2007 04:03 PM 205312]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [04/04/2007 02:59 PM 20760]
S2 BandLuxe_Service;BandLuxe Service;c:\program files\BandRich\BandLuxe HSDPA Utility R11\BRService.exe [12/11/2008 10:20 AM 87264]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [08/07/2008 02:37 PM 24880]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{05b9135a-a518-11dd-b2fd-002186882ef1}]
\shell\AutoRun\command - w0o.com
\shell\explore\Command - w0o.com
\shell\open\Command - w0o.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0a7248a9-cd42-11dd-a1b5-0022644c708b}]
\shell\AutoRun\command - E:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0a724a50-cd42-11dd-a1b5-0022644c708b}]
\shell\AutoRun\command - E:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{58fc97a1-119b-11de-ae93-0022644c708b}]
\shell\AutoRun\command - dbrxubcw.com
\shell\open\Command - dbrxubcw.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7e81ffe5-2062-11de-a2f6-00218688ee41}]
\shell\AutoRun\command - E:\AUTORUN_BANDLUXE.EXE /EjectCDROM
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa756ff4-cbb2-11dd-acbd-00218688ee41}]
\shell\AutoRun\command - E:\skin.EXE /AUTORUN
\shell\explore\Command - E:\skin.exe
\shell\open\Command - E:\skin.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e5a8f09e-c168-11dd-8665-00218688ee41}]
\shell\AutoRun\command - F:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
2009-04-13 c:\windows\Tasks\DriverCure.job
- c:\program files\ParetoLogic\DriverCure\DriverCure.exe [01/21/2009 08:38 AM]
2009-04-12 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [01/21/2009 08:36 AM]
2009-04-12 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [01/21/2009 08:36 AM]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Settings,ProxyOverride = local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: تحميل الكل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetVL.htm
DPF: Microsoft XML Parser for Java -
DPF: {C171FF59-8C55-4796-A398-4F5D02B4C763} - hxxp://76.76.24.125/imscp/talks3n.cab
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-13 16:01
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\users\user\AppData\Local\Temp\catchme.dll 53248 bytes executable
scan completed successfully
hidden files: 1
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-2162471566-51539683-475143137-1000_Classes\CLSID\{120d23b4-76b3-40ce-a168-bcc5227789c5}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:00000030
"Therad"=dword:00000007
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,21,f9,e0,0f,20,d2,a5,f4,2a,95,b2,42,df,2b,22,8f,d0,ea,dc,a1,93,43,\
[HKEY_USERS\S-1-5-21-2162471566-51539683-475143137-1000_Classes\CLSID\{17f50c7f-c708-4fd9-b2f9-7a56ded61ea6}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:0000014f
"Therad"=dword:0000001d
[HKEY_USERS\S-1-5-21-2162471566-51539683-475143137-1000_Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"scansk"=hex(0):be,fc,cb,85,18,b7,10,d3,0d,2e,61,56,fe,c7,28,1f,19,b7,71,de,bd,
b9,4a,4b,52,c9,bd,fb,e8,20,38,25,19,59,44,4a,a1,b7,31,22,00,00,00,00,00,00,\
[HKEY_USERS\S-1-5-21-2162471566-51539683-475143137-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):b6,4b,b1,70,79,2a,b7,9d,ea,54,f7,dd,15,3a,ca,ab,72,1f,d4,b9,48,
3c,ce,47,e0,12,f4,2c,fe,41,cd,0d,97,f2,21,ed,f7,12,62,9f,00,00,00,00,00,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(748)
c:\progra~1\KASPER~1\KASPER~2.0\r3hook.dll
c:\windows\system32\NSI.dll
- - - - - - - > 'lsass.exe'(684)
c:\progra~1\KASPER~1\KASPER~2.0\r3hook.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll
.
Completion time: 04/13/2009 16:05
ComboFix-quarantined-files.txt 2009-04-13 13:05
Pre-Run: 96,077,524,992 bytes free
Post-Run: 95,903,551,488 bytes free
238 --- E O F --- 2009-04-11 06:01
