التقرير الاول
ComboFix 09-05-05.04 - Admin 05/06/2009 15:20.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.974.1033.18.1023.601 [GMT 3:00]
Running from: d:\my documents\Downloads\Programs\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Admin\Application Data\BITS
c:\documents and settings\Admin\Application Data\BITS\BITS.ini
c:\documents and settings\Admin\Application Data\BITS\DHTTable.dat
c:\documents and settings\Admin\Application Data\BITS\ProxyList.ini
c:\documents and settings\Admin\Application Data\BITS\Torrent\20090212162646.torrent.hybridlist
c:\documents and settings\Admin\Application Data\BITS\Torrent\20090301011616.torrent
c:\documents and settings\Admin\Application Data\BITS\Torrent\20090301011616.torrent.~tmp
c:\documents and settings\Admin\Application Data\BITS\Torrent\20090301011616.torrent.bits
c:\documents and settings\Admin\Application Data\BITS\Torrent\20090301011616.torrent.filelist
c:\documents and settings\Admin\Application Data\BITS\UPnP.ini
c:\program files\FlashGet Network
c:\program files\FlashGet Network\FlashGet universal\dbtrans_verbose.log
c:\program files\FlashGet Network\FlashGet universal\fgoption.ini
c:\program files\FlashGet Network\FlashGet universal\flashget.exe.BAK
c:\program files\FlashGet Network\FlashGet universal\P2PCfg.ini
c:\program files\FlashGet Network\FlashGet universal\p2spmgr.ini
c:\program files\FlashGet Network\FlashGet universal\p4spmgr.ini
c:\program files\FlashGet Network\FlashGet universal\Profiles\config.dat
c:\program files\FlashGet Network\FlashGet universal\Profiles\tasks.dat
c:\program files\FlashGet Network\FlashGet universal\transaction.log
c:\windows\system32\kakle.dll
c:\windows\system32\winitn.dll
.
((((((((((((((((((((((((( Files Created from 2009-04-06 to 2009-05-06 )))))))))))))))))))))))))))))))
.
2009-05-06 12:11 . 2009-05-06 12:11 -------- d-sh--w c:\documents and settings\Admin\PrivacIE
2009-05-06 12:11 . 2009-05-06 12:11 -------- d-sh--w c:\documents and settings\Admin\IECompatCache
2009-05-06 12:04 . 2009-05-06 12:04 -------- d-sh--w c:\documents and settings\NetworkService\IETldCache
2009-05-06 12:04 . 2009-05-06 12:04 -------- d-sh--w c:\documents and settings\Admin\IETldCache
2009-05-06 11:27 . 2009-05-06 11:27 -------- d-----w c:\windows\ie8updates
2009-05-06 11:27 . 2009-02-28 04:55 105984 ------w c:\windows\system32\dllcache\iecompat.dll
2009-05-06 11:24 . 2009-05-06 11:27 -------- dc-h--w c:\windows\ie8
2009-05-05 18:52 . 2009-05-05 18:52 -------- d-----w c:\program files\M Autorun Killer 1.0
2009-05-03 19:50 . 2009-05-03 19:53 63 ----a-w c:\windows\AlfaStart.CMD
2009-05-03 19:48 . 2009-05-03 19:48 -------- d-----w c:\program files\Alfa Autorun Killer 2
2009-05-02 19:12 . 2009-05-02 19:12 -------- d-----w c:\windows\lhsp
2009-05-02 19:10 . 2009-05-02 19:11 -------- d-----w c:\windows\speech
2009-05-02 19:10 . 2009-05-02 19:10 -------- d-----w c:\program files\Ariss
2009-05-02 19:09 . 2001-01-22 10:47 304128 ----a-w c:\windows\IsUninst.exe
2009-05-02 19:09 . 2009-05-02 19:09 -------- d-----w c:\documents and settings\Admin\WINDOWS
2009-05-02 10:22 . 2009-05-02 10:22 -------- d-----w C:\tazebama.log
2009-05-02 10:22 . 2009-05-02 10:22 -------- d-----w C:\zPharaoh.dat
2009-05-02 10:22 . 2009-05-02 10:22 -------- d-----w c:\documents and settings\tazebama.dl_Virus
2009-05-02 10:22 . 2009-05-02 10:22 -------- d-----w c:\documents and settings\hook.dl_Virus
2009-05-02 10:22 . 2009-05-02 10:22 -------- d-----w c:\documents and settings\tazebama.dllvirus
2009-05-01 11:39 . 2009-05-01 11:39 -------- d-----w c:\program files\Net Studio
2009-05-01 11:01 . 2009-05-02 18:50 -------- d-----w c:\windows\system32\NtmsData
2009-04-20 12:18 . 2009-04-25 20:46 -------- d-----w C:\download
2009-04-20 11:24 . 2009-04-25 19:36 -------- d-----w c:\documents and settings\Admin\Application Data\Offline Explorer
2009-04-20 11:23 . 2009-05-03 21:32 -------- d-----w c:\program files\Offline Explorer Enterprise
2009-04-19 08:26 . 2009-04-19 10:53 -------- d-----w C:\SnagitPortable
2009-04-18 11:41 . 2009-04-18 12:02 -------- d-----w c:\program files\IrfanView
2009-04-15 04:05 . 2009-02-03 19:59 56832 ------w c:\windows\system32\dllcache\secur32.dll
2009-04-15 04:05 . 2009-03-21 14:06 989696 ------w c:\windows\system32\dllcache\kernel32.dll
2009-04-15 04:02 . 2008-06-12 14:23 91648 ------w c:\windows\system32\dllcache\mtxoci.dll
2009-04-15 04:02 . 2008-06-12 14:23 161792 ------w c:\windows\system32\dllcache\msdtcuiu.dll
2009-04-15 04:02 . 2008-06-12 14:23 66560 ------w c:\windows\system32\dllcache\mtxclu.dll
2009-04-15 04:02 . 2008-06-12 14:23 58880 ------w c:\windows\system32\dllcache\msdtclog.dll
2009-04-15 04:02 . 2008-06-12 14:23 956928 ------w c:\windows\system32\dllcache\msdtctm.dll
2009-04-15 04:02 . 2008-12-16 12:30 354304 ------w c:\windows\system32\dllcache\winhttp.dll
2009-04-15 04:01 . 2009-03-06 14:22 284160 ------w c:\windows\system32\dllcache\pdh.dll
2009-04-15 04:01 . 2009-02-06 10:39 35328 ------w c:\windows\system32\dllcache\sc.exe
2009-04-15 04:01 . 2009-02-09 12:10 401408 ------w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 04:01 . 2009-02-06 11:11 110592 ------w c:\windows\system32\dllcache\services.exe
2009-04-15 04:01 . 2009-02-09 12:10 473600 ------w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 04:01 . 2009-02-06 10:10 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 04:01 . 2009-02-09 12:10 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 04:01 . 2009-02-09 12:10 729088 ------w c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 04:01 . 2009-02-09 12:10 617472 ------w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 04:01 . 2009-02-09 12:10 714752 ------w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 03:55 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-04-15 03:55 . 2008-04-21 12:08 215552 ------w c:\windows\system32\dllcache\wordpad.exe
2009-04-10 21:23 . 2009-04-10 21:27 -------- d-----w c:\program files\Free Screen Recorder
2009-04-06 13:02 . 2009-04-06 13:02 -------- d-----w c:\program files\Elaborate Bytes
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-06 12:25 . 2009-02-03 05:22 86936 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-06 12:25 . 2009-02-03 05:22 819232 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-06 12:25 . 2009-02-03 05:22 4928 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-06 12:25 . 2009-02-03 05:22 10587168 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-06 04:01 . 2009-02-03 03:42 -------- d-----w c:\program files\Microsoft Works
2009-05-03 21:29 . 2009-02-17 00:38 -------- d-----w c:\program files\IslamicPlayer
2009-05-01 11:39 . 2009-03-22 08:31 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-09 13:18 . 2009-02-03 03:09 380336 ----a-w c:\documents and settings\Admin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-31 02:39 . 2009-02-12 06:57 -------- d-----w c:\program files\ImTOO
2009-03-26 09:56 . 2009-03-25 20:18 -------- d-----w c:\program files\WinVDRPRO
2009-03-25 20:13 . 2009-03-25 20:13 -------- d-----w c:\program files\BSR Screen Recorder 4
2009-03-25 18:01 . 2009-03-18 20:36 -------- d-----w c:\program files\WMR11
2009-03-25 13:24 . 2009-03-25 13:24 -------- d-----w c:\program files\Nitro PDF
2009-03-25 13:24 . 2009-03-25 13:24 -------- d-----w c:\program files\Common Files\Nitro PDF
2009-03-25 13:24 . 2009-03-25 13:24 -------- d-----w c:\program files\Common Files\BCL Technologies
2009-03-23 13:32 . 2009-03-23 13:32 -------- d-----w c:\program files\Notepad++Portable
2009-03-22 08:33 . 2009-03-22 08:31 -------- d-----w c:\program files\SmarThru 4
2009-03-22 08:32 . 2009-03-22 08:32 -------- d-----w c:\program files\Readiris
2009-03-22 08:31 . 2009-03-22 08:31 -------- d-----w c:\program files\Common Files\InstallShield
2009-03-22 08:27 . 2009-03-22 08:27 -------- d-----w c:\program files\Samsung
2009-03-19 21:12 . 2009-03-16 19:54 -------- d-----w c:\program files\Internet Download Manager
2009-03-19 10:22 . 2009-03-19 10:22 -------- d-----w c:\program files\HP
2009-03-18 20:39 . 2009-03-18 20:38 -------- d-----w c:\program files\WinPcap
2009-03-13 07:38 . 2009-03-13 07:37 -------- d-----w c:\program files\K-Lite Codec Pack
2009-03-08 01:34 . 2007-10-13 12:05 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 01:34 . 2007-10-13 12:04 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 01:33 . 2007-10-13 12:03 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 01:33 . 2007-10-13 12:05 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 01:32 . 2007-10-13 12:03 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 01:32 . 2007-10-13 12:03 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 01:31 . 2007-10-13 12:03 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 01:31 . 2007-10-13 12:04 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 01:31 . 2007-10-13 12:04 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 01:22 . 2007-10-13 12:04 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:22 . 2007-10-13 12:04 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-06 09:44 . 2009-03-06 09:41 5 ----a-w c:\windows\system32\SySRMAC.dat
2009-03-05 12:07 . 2009-03-05 12:07 737280 ----a-w c:\windows\iun6002.exe
2009-03-04 13:27 . 2009-03-04 13:27 508200 ----a-w c:\windows\system32\ICCProfiles.dll
2009-02-21 05:25 . 2008-12-31 14:04 691592 ----a-w c:\windows\system32\OGACheckControl.DLL
2009-02-17 22:23 . 2009-02-17 22:23 32 ----a-w C:\temp.tmp
2009-02-17 21:32 . 2009-02-03 01:32 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-02-17 05:09 . 2009-02-17 05:09 0 ----a-w c:\windows\ativpsrm.bin
2009-02-16 08:00 . 2009-02-16 08:00 344064 ----a-w c:\windows\system32\dkll.dll
2009-02-16 08:00 . 2009-02-16 08:00 1986560 ----a-w c:\windows\system32\akll.dll
2009-02-16 08:00 . 2009-02-16 08:00 196608 ----a-w c:\windows\system32\maag.dll
2009-02-16 08:00 . 2009-02-16 08:00 1212416 ----a-w c:\windows\system32\ckll.dll
2009-02-13 21:49 . 2009-02-13 09:51 720896 ----a-w c:\windows\iun6002ev.exe
2009-02-11 07:04 . 2008-01-30 01:29 33808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-02-09 18:56 . 2009-03-13 07:37 67584 ----a-w c:\windows\system32\ff_vfw.dll
2009-02-09 12:10 . 2007-10-13 12:04 729088 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2007-10-13 12:04 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 12:10 . 2007-10-13 12:04 714752 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2007-10-13 12:03 617472 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 11:13 . 2007-10-13 12:05 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-06 11:11 . 2007-10-13 12:04 110592 ----a-w c:\windows\system32\services.exe
2009-02-06 11:06 . 2007-10-13 12:04 2145280 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2007-10-13 12:04 35328 ----a-w c:\windows\system32\sc.exe
2009-02-06 10:32 . 2007-07-27 07:51 2023936 ----a-w c:\windows\system32\ntkrnlpa.exe
2007-09-16 06:35 . 2009-02-03 01:49 66408 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2007-09-16 06:35 . 2009-02-03 01:49 54112 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2007-09-16 06:35 . 2009-02-03 01:49 34688 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2007-09-16 06:35 . 2009-02-03 01:49 46456 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2007-09-16 06:35 . 2009-02-03 01:49 171880 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="d:\my documents\??? C?E?C?? C??????E (Portable)\Portable Apps v1.5\Portable Apps\WindowsLiveMessengerPortable v8.0.812.exe" [?]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-03-16 2745776]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-11 206088]
"USBFW"="c:\program files\Net Studio\USB FireWall\USB FireWall.exe" [2008-09-01 1330688]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-02-21 185896]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2007-05-18 1230848]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2007-10-13 44544]
"SetDefaultMIDI"="MIDIDEF.EXE" - c:\windows\MIDIDEF.EXE [2006-08-17 25600]
"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-03-08 128512]
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Shortcut to autorun.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Shortcut to autorun.exe.lnk
backup=c:\windows\pss\Shortcut to autorun.exe.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Shortcut to RocketDock.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Shortcut to RocketDock.lnk
backup=c:\windows\pss\Shortcut to RocketDock.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office Communicator\\communicator.exe"=
R0 BootScreen;BootScreen;\SystemRoot\\SystemRoot\System32\drivers\vidstub.sys --> \SystemRoot\\SystemRoot\System32\drivers\vidstub.sys [?]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [1/30/2008 4:29 AM 33808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [3/14/2008 5:02 AM 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [5/1/2008 4:06 AM 24592]
R3 SMC55T;SMC EZ Card 10/100 (SMC1255TX-PF);c:\windows\system32\drivers\SMC55T51.sys [2/2/2009 8:13 PM 39040]
S2 IcRecUsb;IC Recorder Driver;c:\windows\system32\drivers\IcRecUsb.sys [3/4/2009 7:08 PM 17432]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys --> c:\windows\system32\drivers\npf.sys [?]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Nitro PDF Professional]
cscript //B "c:\program files\Nitro PDF\Professional\RemoveOldAddins.vbs"
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{34A19196-274E-4D75-9D30-D7A45A0A4178}]
"%ProgramFiles%\Windows Sidebar\.\regsvr32.exe" /s wlsrvc.dll
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6B9228DA-9C15-419e-856C-19E768A13BDC}]
"%ProgramFiles%\Windows Sidebar\.\regsvr32.exe" /s sbdrop.dll
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
HIDEC /W "%VAIOTOOLS%\regtlib.exe" "%ProgramFiles%\Windows Sidebar\sidebar.exe"
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-zyz1 - c:\zyz_auto_killer\run2.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.islamacademy.net/
uInternet Connection Wizard,ShellNext = hxxp://linktarget.ashampoo.com/linktarget/?target=trial&edition=eid=2290
uInternet Settings,ProxyOverride = 127.0.0.1
IE: + Offline &Explorer: Download the link -
files\Offline Explorer Enterprise\Add_UrlO.htm
IE: + Offline E&xplorer: Download the current page -
files\Offline Explorer Enterprise\Add_AllO.htm
IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
FF - ProfilePath -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-06 15:27
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1f4b5693-a4c8-424b-bc61-6eef47ac326e}]
@Denied: (Full) (Everyone)
"Model"=dword:00000053
"Therad"=dword:00000008
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,88,c5,fd,72,c6,
82,0e,12,05,98,32,02,34,2b,da,61,3b,3d,45,32,95,91,13,db,53,d1,ac,df,d3,e5,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):2f,b0,da,6b,69,9f,ae,ab,67,bb,00,ff,d6,37,b2,bb,b2,5b,f5,cd,96,
0b,4f,59,57,f4,1d,41,8c,fe,51,d4,a2,45,e0,bd,c8,af,e8,8c,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\â*¬ 9 a*v*i*_*a*u*t*o*_*f*i*l*e*\shell\open\command]
@="\"c:\\Documents and Settings\\Admin\\Desktop\\CrystalPro.exe\" \"%1\""
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(944)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(2464)
c:\windows\system32\ieframe.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-05-06 15:33 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-06 12:33
Pre-Run: 28,970,061,824 bytes free
Post-Run: 30,836,203,520 bytes free
Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
281 --- E O F --- 2009-05-06 12:06
