هذا بخصوص الاول والثاني بالطريق..
ComboFix 09-04-19.01 - Admin 04/19/2009 3:27.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.1014.581 [GMT 3:00]
Running from: c:\documents and settings\Admin\My Documents\Downloads\Programs\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\Admin\LOCALS~1\Temp\tmp2.tmp
c:\windows\system32\_000017_.tmp.dll
.
((((((((((((((((((((((((( Files Created from 2009-03-19 to 2009-04-19 )))))))))))))))))))))))))))))))
.
2009-04-18 23:23 . 2008-04-15 12:00 28288 -c--a-w c:\windows\system32\dllcache\xjis.nls
2009-04-18 23:21 . 2008-04-15 12:00 36927 -c--a-w c:\windows\system32\dllcache\padrs411.dll
2009-04-18 23:20 . 2008-04-15 12:00 13463552 -c--a-w c:\windows\system32\dllcache\hwxjpn.dll
2009-04-18 23:19 . 2008-04-15 12:00 7168 -c--a-w c:\windows\system32\dllcache\wamregps.dll
2009-04-18 23:17 . 2009-04-18 23:17 488 ---ha-r c:\windows\system32\logonui.exe.manifest
2009-04-18 23:17 . 2009-04-18 23:17 749 ---ha-r c:\windows\WindowsShell.Manifest
2009-04-18 23:17 . 2009-04-18 23:17 749 ---ha-r c:\windows\system32\wuaucpl.cpl.manifest
2009-04-18 23:17 . 2009-04-18 23:17 749 ---ha-r c:\windows\system32\sapi.cpl.manifest
2009-04-18 23:17 . 2009-04-18 23:17 749 ---ha-r c:\windows\system32\nwc.cpl.manifest
2009-04-18 23:17 . 2009-04-18 23:17 749 ---ha-r c:\windows\system32\ncpa.cpl.manifest
2009-04-18 22:41 . 2001-09-18 11:03 45056 -c--a-w c:\windows\system32\dllcache\EXCH_aqadmin.dll
2009-04-18 20:07 . 2008-04-15 12:00 16825 ----a-r c:\windows\SET6C.tmp
2009-04-18 20:07 . 2008-04-15 12:00 1088840 ----a-r c:\windows\SET60.tmp
2009-04-18 20:06 . 2008-04-15 12:00 1233103 ----a-r c:\windows\SET5C.tmp
2009-04-18 19:47 . 2008-04-15 12:00 208384 ----a-w c:\windows\system32\OLD94.tmp
2009-04-18 19:43 . 2009-04-18 19:43 -------- d-----w c:\documents and settings\Administrator.TCC-5EE18DB0D01.000\Application Data\mIRC
2009-04-18 18:43 . 2008-04-15 12:00 16825 ----a-r c:\windows\SET6A.tmp
2009-04-18 18:43 . 2008-04-15 12:00 1088840 ----a-r c:\windows\SET5E.tmp
2009-04-18 18:43 . 2008-04-15 12:00 1233103 ----a-r c:\windows\SET5B.tmp
2009-04-18 18:42 . 2009-04-18 22:51 672698 ----a-w c:\windows\setupapi.old
2009-04-18 17:42 . 2009-04-19 00:26 1374 ----a-w c:\windows\imsins.BAK
2009-04-18 17:42 . 2008-04-15 12:00 16825 ----a-r c:\windows\SET93.tmp
2009-04-18 17:42 . 2008-04-15 12:00 1088840 ----a-r c:\windows\SET87.tmp
2009-04-18 17:42 . 2008-04-15 12:00 1233103 ----a-r c:\windows\SET84.tmp
2009-04-16 23:54 . 2009-04-16 23:54 -------- d-----w c:\documents and settings\Admin\Application Data\dvdcss
2009-04-16 21:01 . 2009-04-16 22:45 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-04-16 17:59 . 2006-07-22 20:49 5376 ----a-w c:\windows\system32\antiwpa.dll
2009-04-16 16:31 . 2009-04-16 16:31 -------- d-----w c:\windows\system32\config\systemprofile\Application Data\ESET
2009-04-14 20:02 . 2009-04-14 20:02 -------- d-----w c:\documents and settings\Admin\fontconfig
2009-04-14 19:45 . 2009-04-14 19:45 -------- d-----w c:\documents and settings\Admin\Application Data\GRETECH
2009-04-14 12:00 . 2006-05-13 18:29 843 ----a-w C:\ChangeWinXPKey.vbs
2009-04-14 00:57 . 2009-02-13 08:31 55640 ----a-w c:\windows\system32\drivers\avgntflt.sys
2009-04-14 00:57 . 2009-04-14 12:55 -------- d-----w c:\documents and settings\All Users\Application Data\Avira
2009-04-13 20:07 . 2009-04-14 16:03 -------- d-----w c:\documents and settings\All Users\Application Data\Bandoo
2009-04-13 20:04 . 2009-04-13 20:04 -------- d-----w c:\documents and settings\Admin\Application Data\HiYo
2009-04-13 18:54 . 2009-04-13 18:54 -------- d-----w c:\documents and settings\Admin\Application Data\HiYo(2)
2009-04-13 18:54 . 2009-04-13 18:54 -------- d-----w c:\documents and settings\All Users\Application Data\HiYo
2009-04-13 18:29 . 2009-04-13 20:07 -------- d-----w c:\documents and settings\All Users\Application Data\Bandoo(2)
2009-04-13 15:39 . 2009-04-13 15:39 -------- d-----w c:\documents and settings\LocalService\Local Settings\Application Data\ESET
2009-04-13 14:42 . 2006-06-29 10:07 14048 ------w c:\windows\system32\spmsg2.dll
2009-04-13 14:36 . 2009-04-13 14:36 -------- d-----w c:\windows\system32\XPSViewer
2009-04-13 14:35 . 2008-07-06 12:06 575488 ------w c:\windows\system32\xpsshhdr.dll
2009-04-13 14:35 . 2008-07-06 12:06 117760 ------w c:\windows\system32\prntvpt.dll
2009-04-13 14:35 . 2008-07-06 12:06 1676288 ------w c:\windows\system32\xpssvcs.dll
2009-04-13 12:40 . 2009-04-13 12:40 -------- d-----w c:\documents and settings\All Users\Application Data\{66E2F539-12B6-4870-A500-7689CDE75C5E}
2009-04-10 19:48 . 2009-04-10 19:48 -------- d-----w c:\windows\Sun
2009-04-10 03:35 . 2009-04-10 03:35 -------- d-----w c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-04-10 03:35 . 2009-04-10 03:35 -------- d-----w c:\documents and settings\Admin\Local Settings\Application Data\Downloaded Installations
2009-04-10 03:20 . 2009-04-10 03:20 -------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-04-10 01:28 . 2003-11-04 12:11 159744 ----a-w c:\windows\system32\lfpng13n.dll
2009-04-10 01:27 . 2003-11-04 12:10 69632 ----a-w c:\windows\system32\lfgif13n.dll
2009-04-10 01:27 . 2004-05-14 13:53 462848 ----a-w c:\windows\system32\ltkrn13n.dll
2009-04-10 01:27 . 2004-05-14 13:53 450560 ----a-w c:\windows\system32\ltimg13n.dll
2009-04-10 01:27 . 2004-05-14 13:53 299008 ----a-w c:\windows\system32\ltdis13n.dll
2009-04-10 01:27 . 2004-05-14 13:53 163840 ----a-w c:\windows\system32\ltfil13n.dll
2009-04-10 01:27 . 2004-05-14 13:53 57344 ----a-w c:\windows\system32\lfbmp13n.dll
2009-04-10 01:27 . 2004-05-14 13:53 401408 ----a-w c:\windows\system32\lfcmp13n.dll
2009-04-10 01:27 . 2004-01-11 23:09 206336 ----a-w c:\windows\system32\ltefx13n.dll
2009-04-10 01:11 . 2009-04-03 18:18 33256 ----a-w c:\windows\system32\drivers\hssdrv.sys
2009-04-09 22:32 . 2009-04-09 22:52 -------- d-----w c:\windows\LastGood(2)
2009-04-09 22:25 . 2009-04-09 22:55 -------- d-sh--w C:\RECYCLER(3)
2009-04-09 20:11 . 2009-04-09 22:52 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft
2009-04-09 20:11 . 2009-04-09 22:52 -------- d-s---w c:\documents and settings\Administrator
2009-04-09 19:02 . 2008-04-15 12:00 9728 -c--a-w c:\windows\system32\dllcache\reset.exe
2009-04-09 19:02 . 2008-04-15 12:00 9728 ----a-w c:\windows\system32\reset.exe
2009-04-09 18:48 . 2008-04-15 12:00 16825 ----a-r c:\windows\SET5F.tmp
2009-04-09 18:48 . 2008-04-15 12:00 1088840 ----a-r c:\windows\SET53.tmp
2009-04-09 18:48 . 2008-04-15 12:00 1233103 ----a-r c:\windows\SET50.tmp
2009-04-09 18:36 . 2009-04-09 18:36 4444 ----a-w c:\windows\system32\pid.PNF
2009-04-09 18:36 . 2008-04-15 12:00 16825 ----a-r c:\windows\SET80.tmp
2009-04-09 18:36 . 2008-04-15 12:00 1088840 ----a-r c:\windows\SET74.tmp
2009-04-09 18:36 . 2008-04-15 12:00 1233103 ----a-r c:\windows\SET71.tmp
2009-04-09 18:06 . 2009-04-09 18:06 96976 ----a-w c:\windows\system32\drivers\klin.dat
2009-04-09 18:06 . 2009-04-09 18:06 87855 ----a-w c:\windows\system32\drivers\klick.dat
2009-04-09 18:05 . 2009-04-14 03:23 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-04-09 17:19 . 2009-04-09 17:19 -------- d-----w c:\documents and settings\Admin\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150060}
2009-04-09 17:08 . 2009-04-09 17:08 -------- d-----w c:\documents and settings\All Users\Application Data\Webroot
2009-04-09 17:08 . 2009-04-09 17:08 -------- d-----w c:\documents and settings\Admin\Application Data\Webroot
2009-04-09 15:46 . 2009-04-09 17:08 -------- d-----w c:\documents and settings\All Users\Application Data\Webroot(2)
2009-04-09 02:09 . 2009-04-09 17:12 -------- d-----w c:\documents and settings\Admin\Local Settings\Application Data\AskToolbar
2009-04-09 01:57 . 2009-04-09 01:58 -------- d-----w c:\windows\system32\Adobe
2009-04-09 01:01 . 2009-04-09 01:01 -------- d-----w c:\documents and settings\LocalService\قائمة ابدأ
2009-04-09 00:46 . 2009-04-09 00:46 -------- d-----w c:\documents and settings\Admin\Local Settings\Application Data\Adobe
2009-04-08 23:48 . 2009-04-17 01:34 116 ----a-w c:\windows\NeroDigital.ini
2009-04-08 22:57 . 2009-04-08 22:57 -------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-04-08 22:57 . 2009-04-16 17:54 -------- d-----w c:\documents and settings\Admin\Application Data\SUPERAntiSpyware.com
2009-04-08 22:40 . 2008-04-14 15:59 221184 ----a-w c:\windows\system32\wmpns.dll
2009-04-08 22:33 . 2009-04-19 02:02 -------- d-----w c:\windows\l2schemas
2009-04-08 22:33 . 2009-04-19 02:01 -------- d-----w c:\windows\system32\ar
2009-04-08 22:33 . 2009-04-08 22:33 -------- d-----w c:\windows\system32\bits
2009-04-08 22:29 . 2009-04-08 22:29 -------- d-----w c:\windows\ServicePackFiles
2009-04-08 22:12 . 2004-08-03 19:29 25471 ------w c:\windows\system32\drivers\watv10nt.sys
2009-04-08 22:12 . 2004-08-03 19:29 22271 ------w c:\windows\system32\drivers\watv06nt.sys
2009-04-08 22:12 . 2008-04-13 18:43 14208 ------w c:\windows\system32\drivers\wacompen.sys
2009-04-08 22:12 . 2004-08-03 19:29 11935 ------w c:\windows\system32\drivers\wadv11nt.sys
2009-04-08 22:12 . 2004-08-03 19:29 11871 ------w c:\windows\system32\drivers\wadv09nt.sys
2009-04-08 22:12 . 2004-08-03 19:29 11807 ------w c:\windows\system32\drivers\wadv07nt.sys
2009-04-08 22:12 . 2004-08-03 19:29 11295 ------w c:\windows\system32\drivers\wadv08nt.sys
2009-04-08 22:12 . 2008-04-13 18:36 42240 ------w c:\windows\system32\drivers\viaagp.sys
2009-04-08 22:12 . 2008-04-14 15:59 11325 ------w c:\windows\system32\drivers\vchnt5.dll
2009-04-08 22:12 . 2008-04-13 18:56 12800 ------w c:\windows\system32\drivers\usb8023x.sys
2009-04-08 22:12 . 2008-04-13 18:36 44672 ------w c:\windows\system32\drivers\uagp35.sys
2009-04-08 22:10 . 2008-04-14 15:59 2134528 -c--a-w c:\windows\system32\dllcache\smtpsnap.dll
2009-04-08 22:09 . 2004-07-17 19:55 129045 ------w c:\windows\system32\drivers\cxthsfs2.cty
2009-04-08 20:34 . 2009-04-08 20:34 -------- d-----w c:\documents and settings\Admin\Local Settings\Application Data\ESET
2009-04-08 20:19 . 2009-04-08 20:19 -------- d-----w c:\documents and settings\Admin\Application Data\ESET
2009-04-08 20:18 . 2009-04-16 21:52 -------- d-----w c:\documents and settings\All Users\Application Data\ESET
2009-04-08 19:54 . 2009-04-08 19:54 -------- d-----w c:\documents and settings\Admin\Application Data\CyberScrub
2009-04-08 19:54 . 2009-04-08 19:54 -------- d-----w c:\documents and settings\Admin\Application Data\cleaner
2009-04-08 17:13 . 2009-04-19 00:02 33548 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-08 17:13 . 2009-04-19 00:02 286752 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-04-08 17:13 . 2009-04-19 00:02 2592800 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-08 17:13 . 2009-04-19 00:02 2060 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-04-08 17:08 . 2009-04-08 17:08 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-04-08 16:48 . 2007-08-10 11:28 9728 ----a-w c:\windows\system32\drivers\PELUSBLF.SYS
2009-04-08 16:48 . 2007-06-07 13:38 17408 ----a-w c:\windows\system32\drivers\PELMouse.SYS
2009-04-08 16:47 . 2008-09-11 08:00 147456 ----a-w c:\windows\system32\igfxCoIn_v4990.dll
2009-04-08 16:15 . 2009-04-19 00:13 -------- d-----w c:\documents and settings\Admin\Tracing
2009-04-08 15:30 . 2008-07-30 06:44 110080 ----a-w c:\windows\system32\drivers\IntcHdmi.sys
2009-04-08 15:30 . 2008-09-11 07:52 1481884 ----a-w c:\windows\system32\igkrng400.bin
2009-04-08 15:30 . 2008-06-27 06:08 147456 ----a-w c:\windows\system32\igfxCoIn_v4964.dll
2009-04-08 15:29 . 2009-04-08 15:29 -------- d-----w C:\hp
2009-04-08 14:20 . 2009-04-09 23:49 -------- d-----w c:\documents and settings\All Users\Application Data\DriverScanner
2009-04-08 14:20 . 2009-04-08 14:20 -------- d-----w c:\documents and settings\Admin\Application Data\Uniblue
2009-04-08 13:29 . 2009-04-08 13:29 73728 ----a-w c:\windows\system32\javacpl.cpl
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-19 00:15 . 2001-09-19 12:00 36586 ----a-w c:\windows\system32\perfc001.dat
2009-04-19 00:15 . 2001-09-19 12:00 23892 ----a-w c:\windows\system32\perfh001.dat
2009-04-18 23:52 . 2009-04-08 12:18 -------- d-----w c:\program files\Internet Download Manager
2009-04-18 23:15 . 2009-04-07 08:37 23440 ----a-w c:\windows\system32\emptyregdb.dat
2009-04-18 23:15 . 2009-04-18 23:15 933 ----a-w c:\windows\Inf\COMAD.tmp
2009-04-18 20:55 . 2009-04-07 08:46 95216 ----a-w c:\documents and settings\Admin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-18 20:19 . 2009-04-18 20:19 933 ----a-w c:\windows\Inf\COMAA.tmp
2009-04-18 19:43 . 2009-04-13 21:25 -------- d-----w c:\program files\mIRC
2009-04-18 18:55 . 2009-04-18 18:55 933 ----a-w c:\windows\Inf\COMA8.tmp
2009-04-18 17:56 . 2009-04-18 17:56 933 ----a-w c:\windows\Inf\COMDB.tmp
2009-04-17 04:56 . 2009-04-14 19:55 -------- d-----w c:\program files\MPlayer for Windows
2009-04-17 03:23 . 2009-04-09 18:05 -------- d-----w c:\program files\Kaspersky Lab
2009-04-16 23:25 . 2009-04-08 23:43 -------- d-----w c:\program files\Windows Live Safety Center
2009-04-16 22:45 . 2009-04-07 08:53 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-04-16 21:52 . 2009-04-08 20:18 -------- d-----w c:\program files\ESET
2009-04-16 21:01 . 2009-04-16 21:01 -------- d-----w c:\program files\Common Files\xing shared
2009-04-16 21:01 . 2009-04-07 08:53 -------- d-----w c:\program files\Common Files\Real
2009-04-16 18:34 . 2009-04-08 22:57 -------- d-----w c:\program files\SUPERAntiSpyware
2009-04-14 20:42 . 2009-04-08 13:29 -------- d-----w c:\program files\Java
2009-04-14 20:35 . 2009-04-13 17:26 -------- d-----w c:\program files\Real Alternative
2009-04-14 19:36 . 2009-04-07 08:51 -------- d-----w c:\program files\GRETECH
2009-04-14 02:40 . 2009-04-13 20:07 -------- d-----w c:\program files\Bandoo
2009-04-14 01:48 . 2009-04-08 12:18 6287 ----a-w c:\program files\un_Internet Download Manager_16575.txt
2009-04-13 22:21 . 2009-04-09 18:01 -------- d-----w c:\program files\Hotspot Shield
2009-04-13 20:42 . 2009-04-08 12:23 -------- d-----w c:\program files\Google
2009-04-13 20:07 . 2009-04-13 18:07 -------- d-----w c:\program files\Messenger Plus! Live
2009-04-13 18:54 . 2009-04-13 18:54 -------- d-----w c:\program files\HiYo
2009-04-13 15:52 . 2009-04-13 15:47 -------- d-----w c:\program files\Common Files\delet
2009-04-13 14:36 . 2009-04-13 14:36 -------- d-----w c:\program files\MSBuild
2009-04-13 14:36 . 2009-04-13 14:36 -------- d-----w c:\program files\Reference Assemblies
2009-04-13 13:21 . 2009-04-13 13:21 -------- d-----w c:\program files\Microsoft Windows OneCare Live
2009-04-10 16:52 . 2009-04-07 08:50 -------- d-----w c:\program files\Paltalk Messenger
2009-04-10 16:33 . 2009-04-07 08:50 -------- d-----w c:\documents and settings\Admin\Application Data\Paltalk
2009-04-10 03:36 . 2009-04-07 13:20 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-10 03:09 . 2009-04-10 03:09 12856 ----a-w C:\WinZipErrorReportLog.Txt
2009-04-09 22:53 . 2009-04-09 22:28 -------- d-----w c:\program files\XP TCPIP Repair
2009-04-09 17:20 . 2009-04-09 17:20 -------- d-----w c:\program files\Common Files\Java
2009-04-09 02:05 . 2009-04-09 02:05 -------- d-----w c:\program files\MSSOAP
2009-04-08 22:37 . 2009-04-07 08:40 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-08 22:31 . 2009-04-08 22:31 -------- d-----w c:\program files\Circle Develpement
2009-04-08 20:34 . 2009-04-07 08:49 -------- d-----w c:\program files\Real_SC
2009-04-08 19:38 . 2009-04-08 19:33 -------- d-----w c:\program files\RegCure
2009-04-08 16:59 . 2009-04-07 08:49 4301838 ----a-w c:\windows\java\Packages\YJ9FDBJT.ZIP
2009-04-08 16:59 . 2009-04-07 08:49 5740000 ----a-w c:\windows\java\Packages\N93NPJHJ.ZIP
2009-04-08 16:07 . 2009-04-08 14:27 -------- d-----w c:\program files\Windows Live
2009-04-08 16:06 . 2009-04-08 16:06 -------- d-----w c:\program files\Microsoft
2009-04-08 16:06 . 2009-04-08 16:06 -------- d-----w c:\program files\Windows Live SkyDrive
2009-04-08 15:01 . 2009-04-08 15:01 -------- d-----w c:\program files\Blackstar Dictionary
2009-04-08 13:14 . 2009-04-08 13:14 -------- d-----w c:\program files\CCleaner
2009-04-08 12:50 . 2009-04-08 12:50 -------- d-----w c:\program files\Common Files\Windows Live
2009-04-08 12:34 . 2009-04-07 08:48 -------- d-----w c:\program files\Nero
2009-04-08 12:33 . 2009-04-08 12:33 -------- d-----w c:\program files\Common Files\Adobe AIR
2009-04-08 12:32 . 2009-04-08 12:31 -------- d-----w c:\program files\Common Files\Adobe
2009-04-08 12:22 . 2009-04-08 12:22 -------- d-----w c:\program files\Bodrag
2009-04-08 12:21 . 2009-04-08 12:21 -------- d-----w c:\program files\VS Revo Group
2009-04-07 20:00 . 2009-04-07 08:52 -------- d-----w c:\program files\The KMPlayer
2009-04-07 18:03 . 2009-04-07 18:03 -------- d-----w c:\program files\REALTEK RTL8187 Wireless LAN Driver and Utility
2009-04-07 18:03 . 2009-04-07 13:20 -------- d-----w c:\program files\Common Files\InstallShield
2009-04-07 13:32 . 2009-04-07 13:32 -------- d-----w c:\program files\Microsoft.NET
2009-04-07 13:32 . 2009-04-07 13:32 -------- d-----w c:\program files\Microsoft Works
2009-04-07 13:27 . 2009-04-07 13:27 -------- d-----w c:\program files\CONEXANT
2009-04-07 13:26 . 2009-04-07 13:26 -------- d-----w c:\program files\Marvell
2009-04-07 13:23 . 2009-04-07 13:23 -------- d-----w c:\program files\SigmaTel
2009-04-07 13:21 . 2009-04-07 08:59 -------- d-----w c:\program files\Dell
2009-04-07 13:19 . 2009-04-07 08:55 -------- d-----w c:\program files\Intel
2009-04-07 09:01 . 2009-04-07 09:01 268 ---ha-w C:\sqmdata01.sqm
2009-04-07 09:01 . 2009-04-07 09:01 244 ---ha-w C:\sqmnoopt01.sqm
2009-04-07 09:00 . 2009-04-07 09:00 -------- d-----w c:\program files\WIDCOMM
2009-04-07 08:59 . 2009-04-07 08:59 22729 ----a-w C:\newkey
2009-04-07 08:59 . 2009-04-07 08:59 22729 ----a-w C:\newfile.enc
2009-04-07 08:59 . 2009-04-07 08:59 -------- d-----w c:\documents and settings\Admin\Application Data\InstallShield
2009-04-07 08:56 . 2009-04-07 08:56 268 ---ha-w C:\sqmdata00.sqm
2009-04-07 08:56 . 2009-04-07 08:56 244 ---ha-w C:\sqmnoopt00.sqm
2009-04-07 08:53 . 2009-04-07 08:53 -------- d-----w c:\program files\Real
2009-04-07 08:53 . 2009-04-07 08:53 -------- d-----w c:\program files\VideoLAN
2009-04-07 08:48 . 2009-04-07 08:48 -------- d-----w c:\program files\Common Files\Ahead
2009-04-07 08:42 . 2009-04-07 08:42 -------- d-----w c:\program files\microsoft frontpage
2009-04-07 08:41 . 2009-04-07 08:41 -------- d-----w c:\program files\MSXML 4.0
2009-04-02 11:30 . 2009-04-02 11:30 176752 ----a-w c:\windows\system32\drivers\ssidrv.sys
2009-04-02 11:30 . 2009-04-02 11:30 23152 ----a-w c:\windows\system32\drivers\sshrmd.sys
2009-04-02 11:30 . 2009-04-02 11:30 29808 ----a-w c:\windows\system32\drivers\ssfs0bbc.sys
2009-03-27 06:48 . 2009-04-19 00:14 1203922 ----a-w c:\windows\AppPatch\SET13.tmp
2009-03-03 00:06 . 2009-03-03 00:06 826368 ----a-w c:\windows\system32\SETA.tmp
2009-02-09 14:04 . 2008-04-15 12:00 1846656 ----a-w c:\windows\system32\win32k.sys
2009-02-06 15:52 . 2009-02-06 15:52 49504 ----a-w c:\windows\system32\sirenacm.dll
2008-09-28 19:00 . 2009-04-08 12:18 439440 ----a-w c:\program files\un_Internet Download Manager_16575.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-04-03 2794928]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-15 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2009-04-13 171448]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-04-16 1830128]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MPlayerForWindows_UpdateReminder"="c:\program files\MPlayer for Windows\AutoUpdate.exe" [2009-03-12 80419]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-08 148888]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-16 198160]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-09-11 143360]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-09-11 172032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-09-11 143360]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-03 44544]
"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2007-08-13 123904]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 09:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\bandoo\bndhook.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
R1 ehdrv;ehdrv; [x]
R2 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [2008-07-09 26488]
R3 pelusblf;USB Mouse Low Filter Driver;c:\windows\system32\DRIVERS\pelusblf.sys [2007-08-10 9728]
R3 SjyPkt;SjyPkt;c:\windows\System32\Drivers\SjyPkt.sys [2002-10-02 13532]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
S1 pelmouse;Mouse Suite Driver;c:\windows\system32\DRIVERS\pelmouse.sys [2007-06-07 17408]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-04-16 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-02-17 55024]
S2 Bandoo Coordinator;Bandoo Coordinator;c:\progra~1\Bandoo\Bandoo.exe [2009-03-26 2390464]
S2 HssSrv;Hotspot Shield Helper Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [2009-04-03 364008]
S3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\system32\DRIVERS\HssDrv.sys [2009-04-03 33256]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [2008-07-30 110080]
S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187.sys [2007-01-11 194304]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-02-17 7408]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - BITS
.
Contents of the 'Scheduled Tasks' folder
2009-04-19 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-12-29 19:36]
2009-04-08 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-12-29 19:36]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
DPF: Microsoft XML Parser for Java
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-19 03:29
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1908)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\documents and settings\Admin\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
c:\windows\system32\antiwpa.dll
.
Completion time: 2009-04-19 3:30
ComboFix-quarantined-files.txt 2009-04-19 00:30
Pre-Run: 42,695,286,784 bytes free
Post-Run: 42,894,639,104 bytes free
331 --- E O F --- 2009-04-19 00:26
