مآ آعآآد التششغيل و عطلت برنآمج الحمآيه ..
و هذآ التقرير تفضل ..
ComboFix 09-04-13.A2 - عبدالرحمن 04/13/2009 14:59.2 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1025.18.223.76 [GMT 3:00]
Running from: c:\documents and settings\عبدالرحمن\My Documents\Downloads\Programs\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated)
FW: ESET Personal firewall *disabled*
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-03-13 to 2009-04-13 )))))))))))))))))))))))))))))))
.
2009-04-13 11:29 . 2006-03-02 20:42 73728 ----a-w C:\pv.exe
2009-04-13 09:46 . 2008-07-28 14:19 116736 ----a-w c:\windows\system32\drivers\mcdbus.sys
2009-04-13 09:32 . 2009-04-13 09:32 160 ----a-w c:\windows\MyDrivers.ini
2009-04-13 07:43 . 2009-04-13 07:43 558080 ----a-w c:\windows\system32\AutoPartNt.exe
2009-04-13 07:38 . 2009-04-13 07:38 -------- d-----w c:\documents and settings\All Users\Application Data\Acronis
2009-04-13 07:31 . 2009-04-13 07:31 28928 ----a-w c:\windows\system32\drivers\tifsfilt.sys
2009-04-13 07:31 . 2009-04-13 07:31 212288 ----a-w c:\windows\system32\drivers\timntr.sys
2009-04-13 07:31 . 2009-04-13 07:31 82464 ----a-w c:\windows\system32\drivers\snapman.sys
2009-04-12 23:01 . 2009-04-12 23:01 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2009-04-11 21:08 . 2009-04-11 21:08 -------- d-----w c:\documents and settings\عبدالرحمن\Local Settings\Application Data\Yahoo
2009-04-11 21:06 . 2009-04-11 21:06 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-04-11 21:06 . 2009-04-11 21:06 -------- d-----w c:\documents and settings\عبدالرحمن\Application Data\Yahoo!
2009-04-11 21:02 . 2009-04-11 21:02 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2009-04-10 16:56 . 2009-04-10 16:56 -------- d-----w c:\documents and settings\عبدالرحمن\Local Settings\Application Data\Google
2009-04-08 13:13 . 2009-04-08 13:13 -------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-04-07 21:23 . 2009-04-07 21:23 -------- d-sh--w c:\documents and settings\LocalService\IETldCache
2009-04-07 20:45 . 2009-04-07 20:45 -------- d--h--w c:\windows\ie8
2009-04-07 16:25 . 2006-10-26 16:56 32592 ----a-w c:\windows\system32\msonpmon.dll
2009-04-07 16:04 . 2009-04-07 16:04 -------- d-----w c:\windows\SHELLNEW
2009-04-07 16:02 . 2009-04-07 16:02 -------- d-----w c:\documents and settings\عبدالرحمن\Local Settings\Application Data\Microsoft Help
2009-04-07 15:58 . 2009-04-07 15:59 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-31 17:22 . 2009-03-31 17:22 -------- d-----w c:\documents and settings\عبدالرحمن\Application Data\SWF.max
2009-03-30 10:29 . 2009-03-30 10:29 -------- d-----w c:\documents and settings\عبدالرحمن\Application Data\OfficeUpdate12
2009-03-30 10:15 . 2009-03-30 10:15 -------- d--h--r C:\MSOCache
2009-03-30 10:01 . 2009-03-30 10:01 -------- d-----w c:\documents and settings\عبدالرحمن\Local Settings\Application Data\Adobe
2009-03-29 17:26 . 2008-04-13 18:39 5504 ----a-w c:\windows\system32\drivers\MSTEE.sys
2009-03-29 17:26 . 2008-04-13 18:39 5504 ----a-w c:\windows\system32\dllcache\mstee.sys
2009-03-29 17:25 . 2008-04-13 18:46 10880 ----a-w c:\windows\system32\drivers\NdisIP.sys
2009-03-29 17:25 . 2008-04-13 18:46 10880 ----a-w c:\windows\system32\dllcache\ndisip.sys
2009-03-29 17:25 . 2008-04-13 18:46 15232 ----a-w c:\windows\system32\drivers\StreamIP.sys
2009-03-29 17:25 . 2008-04-13 18:46 15232 ----a-w c:\windows\system32\dllcache\streamip.sys
2009-03-29 17:25 . 2008-04-14 16:00 16384 ----a-w c:\windows\system32\ipsink.ax
2009-03-29 17:25 . 2008-04-14 16:00 16384 ----a-w c:\windows\system32\dllcache\ipsink.ax
2009-03-29 17:25 . 2008-04-13 18:46 11136 ----a-w c:\windows\system32\drivers\SLIP.sys
2009-03-29 17:25 . 2008-04-13 18:46 11136 ----a-w c:\windows\system32\dllcache\slip.sys
2009-03-29 17:25 . 2008-04-13 18:46 19200 ----a-w c:\windows\system32\drivers\WSTCODEC.SYS
2009-03-29 17:25 . 2008-04-13 18:46 19200 ----a-w c:\windows\system32\dllcache\wstcodec.sys
2009-03-29 17:24 . 2008-04-13 18:46 85248 ----a-w c:\windows\system32\drivers\NABTSFEC.sys
2009-03-29 17:24 . 2008-04-13 18:46 85248 ----a-w c:\windows\system32\dllcache\nabtsfec.sys
2009-03-29 17:24 . 2008-04-13 18:46 17024 ----a-w c:\windows\system32\drivers\CCDECODE.sys
2009-03-29 17:24 . 2008-04-13 18:46 17024 ----a-w c:\windows\system32\dllcache\ccdecode.sys
2009-03-29 17:23 . 2008-04-14 15:59 53760 ----a-w c:\windows\system32\vfwwdm32.dll
2009-03-29 17:23 . 2008-04-14 15:59 53760 ----a-w c:\windows\system32\dllcache\vfwwdm32.dll
2009-03-29 17:23 . 2008-04-14 16:00 43008 ----a-w c:\windows\system32\ksxbar.ax
2009-03-29 17:23 . 2008-04-14 16:00 43008 ----a-w c:\windows\system32\dllcache\ksxbar.ax
2009-03-29 17:23 . 2008-04-14 16:00 91648 ----a-w c:\windows\system32\kswdmcap.ax
2009-03-29 17:23 . 2008-04-14 16:00 91648 ----a-w c:\windows\system32\dllcache\kswdmcap.ax
2009-03-29 17:23 . 2008-04-14 16:00 61952 ----a-w c:\windows\system32\kstvtune.ax
2009-03-29 17:23 . 2008-04-14 16:00 61952 ----a-w c:\windows\system32\dllcache\kstvtune.ax
2009-03-29 17:21 . 2009-03-29 17:22 13824 ----a-w c:\windows\system32\drivers\splitcam.sys
2009-03-29 17:21 . 2003-05-14 18:07 389120 ----a-w c:\windows\system32\actskn43.ocx
2009-03-27 21:09 . 2008-09-16 19:23 168448 ----a-w c:\windows\system32\unrar.dll
2009-03-18 12:27 . 2009-04-03 18:18 33256 ----a-w c:\windows\system32\drivers\hssdrv.sys
2009-03-18 11:58 . 2009-03-18 11:58 95688 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-03-18 11:31 . 2009-03-18 11:31 -------- d-----w c:\documents and settings\عبدالرحمن\Application Data\uniblue
2009-03-18 11:30 . 2009-03-18 11:30 -------- d--h--w c:\documents and settings\All Users\Application Data\{8AE45C14-3559-45A6-AF34-03CE304FA276}
2009-03-18 11:03 . 2009-03-18 11:03 -------- d-sh--w c:\documents and settings\عبدالرحمن\IECompatCache
2009-03-18 11:03 . 2009-03-18 11:03 -------- d-sh--w c:\documents and settings\عبدالرحمن\IECompatCache
2009-03-17 20:25 . 2009-03-17 20:25 -------- d-----w C:\Hamam.Elnesa.Tunisa.DVD.ArabSeed.CoM.KaBoS
2009-03-17 11:01 . 2009-03-17 11:01 -------- d-sh--w c:\documents and settings\عبدالرحمن\PrivacIE
2009-03-17 11:01 . 2009-03-17 11:01 -------- d-sh--w c:\documents and settings\عبدالرحمن\PrivacIE
2009-03-17 11:00 . 2009-03-17 11:00 -------- d-sh--w c:\documents and settings\عبدالرحمن\IETldCache
2009-03-17 11:00 . 2009-03-17 11:00 -------- d-sh--w c:\documents and settings\عبدالرحمن\IETldCache
2009-03-17 10:55 . 2009-03-17 10:55 -------- d-----w c:\windows\ie8updates
2009-03-17 10:54 . 2009-04-07 20:48 1355 ----a-w c:\windows\imsins.BAK
2009-03-17 10:49 . 2009-02-28 04:55 105984 ------w c:\windows\system32\dllcache\iecompat.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-13 11:46 . 2009-02-10 17:58 845856 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-13 11:46 . 2009-02-10 17:58 845856 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-13 11:46 . 2009-02-10 17:58 12032 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-13 09:46 . 2009-04-13 09:46 -------- d-----w c:\program files\MagicDisc
2009-04-12 16:15 . 2009-04-12 16:15 -------- d-----w c:\program files\inKline Global
2009-04-11 22:35 . 2009-04-11 22:35 -------- d-----w c:\program files\
2009-04-11 21:02 . 2009-04-11 21:02 -------- d-----w c:\program files\Yahoo!
2009-04-10 16:55 . 2009-04-10 16:55 -------- d-----w c:\program files\Google
2009-04-08 15:41 . 2009-04-08 15:41 -------- d-----w c:\program files\Common Files\NSV
2009-04-08 15:07 . 2009-01-04 23:02 2850 ----a-w C:\hook.log
2009-04-07 16:54 . 2008-12-31 16:52 99888 ----a-w c:\documents and settings\عبدالرحمن\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-07 16:18 . 2009-04-07 16:18 -------- d-----w c:\program files\Microsoft Works
2009-04-07 16:12 . 2009-04-07 16:12 -------- d-----w c:\program files\Microsoft.NET
2009-04-07 16:07 . 2009-04-07 16:07 -------- d-----w c:\program files\Microsoft Visual Studio 8
2009-04-07 11:07 . 2009-04-07 11:07 -------- d-----w c:\program files\Unlocker
2009-04-06 12:46 . 2009-04-06 12:46 -------- d-----w c:\program files\Windows Installer Clean Up
2009-04-04 12:56 . 2009-01-05 01:11 32768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009010520090106\index.dat
2009-04-04 12:56 . 2009-01-05 01:11 32768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008122920090105\index.dat
2009-04-04 12:52 . 2006-03-02 09:00 71050 ----a-w c:\windows\system32\perfc001.dat
2009-04-04 12:52 . 2006-03-02 09:00 375478 ----a-w c:\windows\system32\perfh001.dat
2009-03-31 17:21 . 2009-03-31 17:21 -------- d-----w c:\program files\SWF.max
2009-03-30 10:01 . 2009-03-30 10:01 -------- d-----w c:\program files\Common Files\Adobe
2009-03-30 09:59 . 2009-03-30 09:59 -------- d-----w c:\program files\Smart PDF Converter Pro
2009-03-29 17:20 . 2009-03-29 17:20 -------- d-----w c:\program files\SplitCam
2009-03-28 08:29 . 2009-03-28 08:29 -------- d-----w c:\program files\Windows Defender
2009-03-27 21:09 . 2009-03-27 21:09 -------- d-----w c:\program files\K-Lite Codec Pack
2009-03-27 21:09 . 2009-03-27 21:09 -------- d-----w c:\program files\AviSynth 2.5
2009-03-27 21:06 . 2009-01-06 15:30 196608 ----a-w c:\windows\system32\maag.dll
2009-03-27 21:06 . 2009-01-06 15:30 1245184 ----a-w c:\windows\system32\bkll.dll
2009-03-27 21:06 . 2009-01-06 15:30 1212416 ----a-w c:\windows\system32\ckll.dll
2009-03-27 21:06 . 2009-01-06 15:30 90112 ----a-w c:\windows\system32\agsaami.dll
2009-03-27 21:06 . 2009-01-06 15:30 2535424 ----a-w c:\windows\system32\agsaamj.dll
2009-03-27 21:06 . 2009-01-06 15:30 1986560 ----a-w c:\windows\system32\akll.dll
2009-03-27 21:06 . 2009-01-06 15:30 610304 ----a-w c:\windows\system32\agsaamg.dll
2009-03-27 21:06 . 2009-01-06 15:30 372736 ----a-w c:\windows\system32\agsaamc.dll
2009-03-21 19:56 . 2009-03-21 19:56 -------- d-----w c:\program files\Common Files\Nullsoft
2009-03-18 11:30 . 2009-03-18 11:30 -------- d-----w c:\program files\Uniblue
2009-03-15 22:41 . 2009-03-15 22:41 -------- d-----w c:\program files\MSECache
2009-03-15 19:46 . 2009-03-15 19:46 -------- d-----w c:\program files\Hotspot Shield
2009-03-15 11:27 . 2009-03-10 09:31 2203 ----a-w C:\rapport.txt
2009-03-11 11:49 . 2009-03-11 11:49 603904 ----a-w c:\windows\system32\TUProgSt.exe
2009-03-11 11:49 . 2009-03-11 11:48 362240 ----a-w c:\windows\system32\TuneUpDefragService.exe
2009-03-11 11:48 . 2009-03-11 11:48 -------- d-----w c:\documents and settings\عبدالرحمن\Application Data\TuneUp Software
2009-03-11 11:47 . 2009-03-11 11:47 -------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2009-03-11 11:47 . 2009-03-11 11:47 -------- d-----w c:\program files\TuneUp Utilities 2009
2009-03-11 11:46 . 2009-03-11 11:46 -------- d-sh--w c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-03-10 19:18 . 2009-03-10 19:18 960392 ------w c:\windows\system32\dllcache\WgaTray.exe
2009-03-10 19:18 . 2009-03-10 19:18 264576 ------w c:\windows\system32\dllcache\wgaLogon.dll
2009-03-08 11:09 . 2009-02-11 07:01 638816 ----a-w c:\windows\system32\dllcache\iexplore.exe
2009-03-08 11:09 . 2009-02-11 07:01 391536 ----a-w c:\windows\system32\dllcache\iedkcs32.dll
2009-03-08 03:36 . 2009-03-08 03:36 -------- d-----w c:\documents and settings\عبدالرحمن\Application Data\DriverCure
2009-03-08 03:36 . 2009-03-08 03:36 -------- d-----w c:\documents and settings\All Users\Application Data\ParetoLogic
2009-03-08 03:36 . 2009-03-08 03:36 -------- d-----w c:\documents and settings\All Users\Application Data\DriverCure
2009-03-08 01:41 . 2009-01-16 18:01 5937152 ----a-w c:\windows\system32\dllcache\mshtml.dll
2009-03-08 01:39 . 2009-02-11 07:00 11063808 ----a-w c:\windows\system32\dllcache\ieframe.dll
2009-03-08 01:34 . 2009-02-11 07:01 914944 ----a-w c:\windows\system32\dllcache\wininet.dll
2009-03-08 01:34 . 2006-03-02 09:00 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 01:34 . 2009-02-11 07:00 1206784 ----a-w c:\windows\system32\dllcache\urlmon.dll
2009-03-08 01:34 . 2009-02-11 07:00 236544 ----a-w c:\windows\system32\dllcache\webcheck.dll
2009-03-08 01:34 . 2009-03-08 01:34 43008 ------w c:\windows\system32\dllcache\licmgr10.dll
2009-03-08 01:34 . 2006-03-02 09:00 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 01:34 . 2009-02-11 07:01 105984 ----a-w c:\windows\system32\dllcache\url.dll
2009-03-08 01:34 . 2009-02-11 07:01 193536 ----a-w c:\windows\system32\dllcache\msrating.dll
2009-03-08 01:34 . 2009-02-11 07:01 109568 ----a-w c:\windows\system32\dllcache\occache.dll
2009-03-08 01:33 . 2009-03-08 01:33 759296 ------w c:\windows\system32\dllcache\VGX.dll
2009-03-08 01:33 . 2009-03-08 01:33 18944 ------w c:\windows\system32\dllcache\corpol.dll
2009-03-08 01:33 . 2006-03-02 09:00 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 01:33 . 2009-02-11 07:01 25600 ----a-w c:\windows\system32\dllcache\jsproxy.dll
2009-03-08 01:33 . 2009-03-08 01:33 726528 ------w c:\windows\system32\dllcache\jscript.dll
2009-03-08 01:33 . 2009-02-11 07:01 229376 ----a-w c:\windows\system32\dllcache\ieaksie.dll
2009-03-08 01:33 . 2009-03-08 01:33 420352 ------w c:\windows\system32\dllcache\vbscript.dll
2009-03-08 01:33 . 2006-03-02 09:00 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 01:33 . 2009-02-11 07:01 125952 ----a-w c:\windows\system32\dllcache\ieakeng.dll
2009-03-08 01:32 . 2009-03-08 01:32 72704 ------w c:\windows\system32\dllcache\admparse.dll
2009-03-08 01:32 . 2006-03-02 09:00 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 01:32 . 2009-02-11 07:00 173056 ----a-w c:\windows\system32\dllcache\ie4uinit.exe
2009-03-08 01:32 . 2009-02-11 07:01 163840 ----a-w c:\windows\system32\dllcache\ieakui.dll
2009-03-08 01:32 . 2009-03-08 01:32 71680 ------w c:\windows\system32\dllcache\iesetup.dll
2009-03-08 01:32 . 2009-02-11 07:01 55808 ----a-w c:\windows\system32\dllcache\iernonce.dll
2009-03-08 01:32 . 2006-03-02 09:00 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 01:32 . 2009-02-11 07:01 128512 ----a-w c:\windows\system32\dllcache\advpack.dll
2009-03-08 01:32 . 2009-03-08 01:32 94720 ------w c:\windows\system32\dllcache\inseng.dll
2009-03-08 01:32 . 2009-02-11 07:01 594432 ----a-w c:\windows\system32\dllcache\msfeeds.dll
2009-03-08 01:32 . 2009-02-11 07:01 1985024 ----a-w c:\windows\system32\dllcache\iertutil.dll
2009-03-08 01:32 . 2009-02-11 07:01 611840 ----a-w c:\windows\system32\dllcache\mstime.dll
2009-03-08 01:24 . 2009-03-08 01:24 68608 ------w c:\windows\system32\dllcache\hmmapi.dll
2009-03-08 01:22 . 2009-03-08 01:22 156160 ------w c:\windows\system32\dllcache\msls31.dll
2009-03-08 01:22 . 2006-03-02 09:00 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-08 01:11 . 2009-02-11 07:00 445952 ----a-w c:\windows\system32\dllcache\ieapfltr.dll
2009-03-07 00:50 . 2009-03-07 00:50 -------- d-----w c:\program files\CyberLat
2009-03-05 04:22 . 2009-03-05 04:22 -------- d-----w c:\program files\Real Alternative
2009-03-04 12:36 . 2009-03-04 12:36 -------- d-----w c:\program files\Total Video Converter
2009-03-04 12:00 . 2009-02-04 00:10 81920 ----a-w c:\documents and settings\عبدالرحمن\Application Data\ezpinst.exe
2009-03-04 12:00 . 2009-02-04 00:10 47360 ----a-w c:\windows\system32\drivers\pcouffin.sys
2009-03-04 12:00 . 2009-02-04 00:10 47360 ----a-w c:\documents and settings\عبدالرحمن\Application Data\pcouffin.sys
2009-03-04 11:20 . 2009-03-04 11:20 -------- d-----w c:\documents and settings\عبدالرحمن\Application Data\nerxy
2009-02-26 07:34 . 2009-02-26 07:34 -------- d-----w c:\program files\IVT Corporation
2009-02-26 06:27 . 2009-02-26 06:26 -------- d-----w c:\documents and settings\عبدالرحمن\Application Data\AVS4YOU
2009-02-26 05:42 . 2009-02-26 05:42 -------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2009-02-26 02:13 . 2009-02-26 02:13 -------- d-----w c:\program files\Common Files\AVSMedia
.
(((((((((((((((((((((((((((((
SnapShot@Mon 04-13-2009_14.39.29.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-10 17:58 . 2009-04-13 11:46 845856 c:\windows\system32\drivers\fidbox.dat
- 2009-02-10 17:58 . 2009-04-13 08:34 845856 c:\windows\system32\drivers\fidbox.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
03/18/2009 03:27 PM 204248 --a------ c:\program files\Hotspot Shield\hssie\HssIE.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [04/14/2008 06:59 PM 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [02/06/2009 06:53 PM 3885408]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [01/06/2009 05:02 PM 2745776]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [04/14/2008 06:59 PM 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [08/24/2007 03:18 AM 437160]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoViewOnDrive"= 12 (0xc)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fsp_lmwl]
02/21/2007 09:21 PM 43376 c:\windows\system32\fsp_lmwl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \
0
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANIWZCS2Service]
--a------ 10/19/2005 06:19 PM 49152 c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioDeck]
-ra------ 08/09/2007 03:48 PM 528384 c:\program files\VIA\VIAudioi\SBADeck\ADeck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Auslogics BoostSpeed 4]
--a------ 01/25/2009 12:57 AM 361584 c:\program files\Auslogics\Auslogics BoostSpeed\BoostSpeed.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cash Sixth]
--a------ 02/07/2009 12:31 AM 615936 c:\docume~1\عبدالر~1\APPLIC~1\MIXTWO~1\Hopemags.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 04/14/2008 06:59 PM 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\D-Link AirPlus G]
--a------ 11/23/2005 03:04 PM 1544192 c:\program files\D-Link\AirPlus G\AirGCFG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
--a------ 01/02/2007 12:22 AM 3739648 c:\program files\Google\Google Talk\googletalk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 01/06/2009 05:02 PM 2745776 c:\program files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
--a------ 03/18/2009 06:50 PM 4363504 c:\program files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 04/14/2003 08:04 PM 1498032 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 02/06/2009 06:53 PM 3885408 c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nodenable]
--a------ 09/23/2008 06:48 PM 326823 c:\program files\ESET\nodenable.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
--a------ 09/07/2006 08:19 PM 15872 c:\program files\Unlocker\UnlockerAssistant.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
--a------ 11/03/2006 07:20 PM 866584 c:\program files\Windows Defender\MSASCui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
--a------ 04/14/2008 07:00 PM 110592 c:\windows\system32\bthprops.cpl
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Crack For IVT_BlueSoleil_6.2.227.11_for_32bit_OS\\Crack For IVT_BlueSoleil_6.2.227.11_for_32bit_OS\\BlueSoleilCS.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\groove.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
R1 SuperMounter;SuperMounter; [x]
R3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\Drivers\btnetBus.sys [12/07/2008 12:44 PM 30088]
R3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\Drivers\IvtBtBus.sys [07/02/2008 02:58 PM 26248]
R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [09/02/2008 04:14 PM 191656]
S0 BtHidBus;Bluetooth HID Bus Service;c:\windows\System32\Drivers\BtHidBus.sys [01/07/2009 11:39 PM 20744]
S1 is-P5K3Odrv;is-P5K3Odrv;c:\windows\system32\DRIVERS\45657767.sys [07/08/2008 01:54 PM 148496]
S2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [10/24/2008 08:51 PM 468224]
S2 HssSrv;Hotspot Shield Helper Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [04/03/2009 09:18 PM 364008]
S2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [01/14/2009 05:53 PM 226656]
S2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\System32\TUProgSt.exe [03/11/2009 02:49 PM 603904]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/03/2006 07:19 PM 13592]
S3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\system32\DRIVERS\HssDrv.sys [04/03/2009 09:18 PM 33256]
S3 LMPC4;LMPC4; [x]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-04-13 c:\windows\Tasks\B548FCF691B766AE.job
- c:\docume~1\9 []
2009-04-13 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [11/20/2008 04:28 PM]
2009-04-13 c:\windows\Tasks\الصيانة بنقرة واحدة.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [11/20/2008 04:28 PM]
2009-04-13 c:\windows\Tasks\User_Feed_Synchronization-{985327D9-AC01-49B3-827B-19DCE6227BFB}.job
- c:\windows\system32\msfeedssync.exe [03/08/2009 04:31 AM]
2009-04-13 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [12/31/2008 05:04 PM]
2009-04-13 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [12/31/2008 05:04 PM]
2009-04-13 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [11/03/2006 07:20 PM]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyServer = speed2.info:95
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
IE: تحميل ملفات FLV الـ 10 الأخيرة بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL2.htm
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-13 15:03
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\sccfg.sys 8192 bytes
scan completed successfully
hidden files: 1
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1060)
c:\windows\system32\fsp_lmwl.dll
- - - - - - - > 'explorer.exe'(3484)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 04/13/2009 15:07
ComboFix-quarantined-files.txt 2009-04-13 12:07
ComboFix2.txt 2009-04-13 11:42
Pre-Run: 2,924,896,256 bytes free
Post-Run: 2,918,506,496 bytes free
326 --- E O F --- 2009-04-13 00:01
.. 
