ComboFix 09-05-06.08 - hamza 05/07/2009 14:41.1 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.964.1033.18.1014.629 [GMT 3:00]
Running from: d:\خااااااااااااااص\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated)
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\hamza\LOCALS~1\Temp\tmp1.tmp
c:\docume~1\hamza\LOCALS~1\Temp\tmp2.tmp
c:\windows\system32\mfc45.dll
.
((((((((((((((((((((((((( Files Created from 2009-04-07 to 2009-05-07 )))))))))))))))))))))))))))))))
.
2009-05-07 10:55 . 2009-05-07 10:55 -------- d--h--w c:\windows\system32\GroupPolicy
2009-05-07 05:50 . 2009-05-07 05:50 -------- d-----w c:\documents and settings\hamza\Bluetooth Software
2009-05-07 05:48 . 2007-05-17 10:35 67960 ----a-w c:\windows\system32\drivers\btwusb.sys
2009-05-07 05:48 . 2007-05-17 10:34 55352 ----a-w c:\windows\system32\drivers\btwhid.sys
2009-05-07 05:48 . 2007-05-17 10:34 149123 ----a-w c:\windows\system32\drivers\btwdndis.sys
2009-05-07 05:48 . 2007-05-17 10:35 106557 ----a-w c:\windows\system32\btw_ci.dll
2009-05-07 05:48 . 2007-05-17 10:34 37424 ----a-w c:\windows\system32\drivers\btport.sys
2009-05-07 05:48 . 2007-05-17 10:34 876384 ----a-w c:\windows\system32\drivers\btkrnl.sys
2009-05-07 05:48 . 2007-05-17 10:34 539072 ----a-w c:\windows\system32\drivers\btaudio.sys
2009-05-07 05:47 . 2009-05-07 05:48 -------- d-----w c:\program files\WIDCOMM
2009-05-04 17:36 . 2009-05-04 17:36 -------- d-----w c:\program files\WIDCOMM(2)
2009-05-04 16:57 . 2009-05-04 16:57 -------- d-----w c:\documents and settings\hamza\Local Settings\Application Data\Identities
2009-05-04 15:48 . 2009-05-04 15:48 -------- d-----w c:\documents and settings\hamza\Local Settings\Application Data\Hotspot_Shield
2009-05-03 10:04 . 2009-05-03 10:04 -------- d-----w c:\documents and settings\hamza\Local Settings\Application Data\Conduit
2009-05-03 10:04 . 2009-05-03 10:04 -------- d-----w c:\program files\Conduit
2009-05-03 10:04 . 2009-05-03 10:04 -------- d-----w c:\program files\Hotspot_Shield
2009-05-02 20:05 . 2009-05-02 20:05 -------- d-----w c:\program files\NeoMatrixes Computing
2009-04-28 18:05 . 2009-04-28 18:07 147 ----a-w c:\windows\itlog.dat
2009-04-28 18:02 . 2009-04-28 18:02 -------- d-----w c:\documents and settings\hamza\Local Settings\Application Data\Help
2009-04-28 18:02 . 2009-04-28 18:02 -------- d-----w c:\program files\security
2009-04-25 06:31 . 2009-04-25 06:32 -------- d-----w c:\documents and settings\hamza\Application Data\Thinstall
2009-04-24 16:11 . 2004-08-11 12:55 110602 ----a-w c:\windows\system32\xcdsfx32.bin
2009-04-24 16:11 . 2004-09-28 08:13 526184 ----a-w c:\windows\system32\XceedCry.dll
2009-04-24 16:11 . 2005-01-12 08:19 456536 ----a-w c:\windows\system32\XCEEDZIP.DLL
2009-04-24 16:11 . 2009-04-24 16:11 -------- d-----w c:\program files\Driver Magician
2009-04-24 15:06 . 2007-10-30 12:39 172032 ----a-w c:\windows\system32\igfxres.dll
2009-04-24 11:05 . 2009-05-07 11:17 12 ----a-w c:\windows\bthservsdp.dat
2009-04-24 08:59 . 2007-10-30 13:00 1843784 ----a-w c:\windows\system32\igklg400.dll
2009-04-24 08:59 . 2007-10-30 13:08 147456 ----a-w c:\windows\system32\igfxCoIn_v4885.dll
2009-04-24 08:59 . 2007-10-30 13:00 104636 ----a-w c:\windows\system32\igmedcompkrn.dll
2009-04-24 08:59 . 2007-10-30 13:00 1399880 ----a-w c:\windows\system32\igklg450.dll
2009-04-24 07:59 . 2009-04-24 07:59 -------- d-----w c:\documents and settings\All Users\Application Data\DriverScanner
2009-04-24 07:59 . 2009-04-24 07:59 -------- d-----w c:\documents and settings\hamza\Application Data\Uniblue
2009-04-24 07:59 . 2009-04-24 07:59 -------- d-----w c:\program files\Uniblue
2009-04-24 07:45 . 2009-04-24 07:45 -------- d--h--w c:\documents and settings\All Users\Application Data\{D5ABFFAD-D592-4F98-B02B-587125B4801F}
2009-04-24 06:29 . 2007-05-04 20:00 105984 ----a-w c:\windows\system32\drivers\IntcHdmi.sys
2009-04-24 06:17 . 2004-08-03 19:59 5504 ----a-w c:\windows\system32\dllcache\intelide.sys
2009-04-24 06:17 . 2004-08-03 19:59 5504 ----a-w c:\windows\system32\drivers\intelide.sys
2009-04-23 21:15 . 2006-08-04 13:39 386560 ----a-w c:\windows\system32\drivers\XAudio.exe
2009-04-23 21:15 . 2006-11-02 15:43 986624 ----a-w c:\windows\system32\drivers\HSX_DPV.sys
2009-04-23 21:15 . 2006-11-07 06:54 172032 ----a-w c:\windows\system32\Uci32114.dll
2009-04-23 21:15 . 2006-11-02 15:42 206848 ----a-w c:\windows\system32\drivers\HSXHWAZL.sys
2009-04-23 21:15 . 2006-08-04 13:39 8192 ----a-w c:\windows\system32\drivers\XAudio.sys
2009-04-23 21:15 . 2006-11-02 15:42 659968 ----a-w c:\windows\system32\drivers\HSX_CNXT.sys
2009-04-23 20:02 . 2009-04-23 20:02 -------- d-----w c:\program files\ma-config.com
2009-04-23 20:02 . 2009-04-23 20:02 -------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com
2009-04-23 18:49 . 2009-04-23 18:49 -------- d-----w c:\documents and settings\hamza\Application Data\iolo
2009-04-23 18:49 . 2009-04-23 18:49 -------- d-----w c:\documents and settings\All Users\Application Data\iolo
2009-04-23 09:14 . 2009-04-23 09:14 -------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-04-23 09:05 . 2009-04-23 09:05 -------- d-----w c:\program files\Windows Media Connect 2
2009-04-23 09:03 . 2009-04-23 09:03 -------- d-----w c:\windows\system32\drivers\UMDF
2009-04-23 09:03 . 2009-04-23 09:03 -------- d-----w c:\windows\system32\LogFiles
2009-04-23 08:45 . 2009-04-23 08:45 -------- d-----w c:\program files\Zoom Player
2009-04-23 08:18 . 2009-04-23 08:18 -------- d-----w c:\program files\Common Files\xing shared
2009-04-23 08:18 . 2009-04-23 08:18 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-04-23 07:58 . 2009-03-10 19:18 453512 ----a-w c:\windows\system32\KB905474\wgasetup.exe
2009-04-23 07:58 . 2009-04-23 07:58 -------- d-----w c:\windows\system32\KB905474
2009-04-23 07:15 . 2009-04-23 07:15 -------- d-----w c:\windows\system32\CatRoot_bak
2009-04-22 21:46 . 2009-04-22 21:46 -------- d-----w c:\documents and settings\All Users\Application Data\GRETECH
2009-04-22 21:45 . 2009-04-22 21:45 -------- d-----w c:\documents and settings\hamza\Application Data\GRETECH
2009-04-22 16:51 . 2003-06-18 14:31 17920 ----a-w c:\windows\system32\mdimon.dll
2009-04-22 16:51 . 2009-04-22 16:51 -------- d-----w c:\program files\Microsoft.NET
2009-04-22 16:50 . 2009-04-22 16:50 -------- d-----w c:\windows\SHELLNEW
2009-04-22 15:51 . 2004-08-03 20:08 26496 ----a-w c:\windows\system32\dllcache\usbstor.sys
2009-04-22 09:29 . 2009-04-22 09:29 -------- d-----w c:\documents and settings\hamza\Application Data\CyberScrub
2009-04-22 09:28 . 2009-04-22 09:28 -------- d-----w c:\documents and settings\hamza\Application Data\cleaner
2009-04-22 07:51 . 2008-06-13 14:10 272128 ----a-w c:\windows\system32\dllcache\bthport.sys
2009-04-22 07:51 . 2008-06-13 14:10 272128 ----a-w c:\windows\system32\drivers\bthport.sys
2009-04-22 07:03 . 2008-10-24 12:25 455936 ------w c:\windows\system32\dllcache\mrxsmb.sys
2009-04-21 21:01 . 2009-04-21 21:01 -------- d-----w c:\program files\GVR
2009-04-21 11:20 . 2009-04-21 11:20 -------- d-----w c:\documents and settings\hamza\Application Data\CyberLink
2009-04-21 11:17 . 2009-04-21 11:17 -------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2009-04-21 11:16 . 2009-04-21 11:16 -------- d-----w c:\program files\CyberLink
2009-04-21 11:08 . 2009-04-21 11:08 -------- d-----w c:\documents and settings\hamza\Application Data\IDM
2009-04-21 11:08 . 2009-04-21 11:08 -------- d-----w c:\program files\Internet Download Manager
2009-04-21 07:20 . 2009-04-21 07:21 -------- d-----w c:\program files\Common Files\Adobe
2009-04-21 07:20 . 2003-04-29 18:07 306688 ----a-w c:\windows\IsUninst.exe
2009-04-21 00:15 . 2004-08-04 16:00 480256 ----a-w c:\windows\system32\dllcache\cintsetp.exe
2009-04-21 00:15 . 2004-08-04 16:00 198656 ----a-w c:\windows\system32\dllcache\cintime.dll
2009-04-21 00:15 . 2004-08-04 16:00 173568 ----a-w c:\windows\system32\dllcache\chtskf.dll
2009-04-21 00:15 . 2004-08-04 16:00 56320 ----a-w c:\windows\system32\dllcache\chtskdic.dll
2009-04-21 00:15 . 2004-08-04 16:00 97792 ----a-w c:\windows\system32\dllcache\chtmbx.dll
2009-04-21 00:14 . 2004-08-04 16:00 57399 ----a-w c:\windows\system32\dllcache\cplexe.exe
2009-04-21 00:14 . 2004-08-04 16:00 1677824 ----a-w c:\windows\system32\dllcache\chsbrkr.dll
2009-04-21 00:14 . 2004-08-04 16:00 838144 ----a-w c:\windows\system32\dllcache\chtbrkr.dll
2009-04-21 00:14 . 2004-08-04 16:00 19456 ----a-w c:\windows\system32\dllcache\agt0404.dll
2009-04-21 00:14 . 2004-08-04 16:00 19456 ----a-w c:\windows\system32\dllcache\agt0804.dll
2009-04-21 00:14 . 2004-08-04 16:00 218112 ----a-w c:\windows\system32\dllcache\c_g18030.dll
2009-04-21 00:14 . 2004-08-04 16:00 44032 ----a-w c:\windows\system32\dllcache\imekrmig.exe
2009-04-21 00:14 . 2004-08-04 16:00 19456 ----a-w c:\windows\system32\dllcache\agt0412.dll
2009-04-21 00:14 . 2004-08-04 16:00 19456 ----a-w c:\windows\system32\dllcache\agt0411.dll
2009-04-21 00:13 . 2004-08-04 16:00 6656 ----a-w c:\windows\system32\dllcache\c_is2022.dll
2009-04-21 00:13 . 2004-08-04 16:00 10752 ----a-w c:\windows\system32\dllcache\c_iscii.dll
2009-04-21 00:13 . 2004-08-04 16:00 19456 ----a-w c:\windows\system32\dllcache\agt0401.dll
2009-04-21 00:13 . 2004-08-04 16:00 19456 ----a-w c:\windows\system32\dllcache\agt040d.dll
2009-04-21 00:09 . 2004-08-04 16:00 19456 ----a-w c:\windows\system32\dllcache\agt041f.dll
2009-04-21 00:09 . 2004-08-04 16:00 19456 ----a-w c:\windows\system32\dllcache\agt0419.dll
2009-04-21 00:09 . 2004-08-04 16:00 22016 ----a-w c:\windows\system32\dllcache\agt0408.dll
2009-04-21 00:09 . 2004-08-04 16:00 19456 ----a-w c:\windows\system32\dllcache\agt0415.dll
2009-04-21 00:09 . 2004-08-04 16:00 19968 ----a-w c:\windows\system32\dllcache\agt040e.dll
2009-04-21 00:09 . 2004-08-04 16:00 19456 ----a-w c:\windows\system32\dllcache\agt0405.dll
2009-04-21 00:09 . 2004-08-04 16:00 8704 ----a-w c:\windows\system32\dllcache\batt.dll
2009-04-20 23:31 . 2009-04-20 23:32 -------- d-sh--w c:\windows\ftpcache
2009-04-20 23:29 . 2009-04-20 23:29 -------- d-----w c:\program files\Nufsoft
2009-04-20 23:29 . 2009-04-20 23:29 -------- d-----w c:\documents and settings\All Users\Application Data\TEMP
2009-04-20 23:19 . 2009-04-20 23:19 -------- d-----w c:\program files\ShaPlus Google Translator
2009-04-20 22:23 . 2009-04-20 22:23 -------- d-----w c:\documents and settings\hamza\Application Data\DMCache
2009-04-20 22:22 . 2004-07-03 05:08 139264 ----a-w c:\windows\system32\xvidvfw.dll
2009-04-20 22:22 . 2008-03-02 17:40 742220 ----a-w c:\windows\system32\xvidcore.dll
2009-04-20 22:22 . 2007-03-09 06:36 81920 ----a-w c:\windows\system32\viscomwave.dll
2009-04-20 22:22 . 2007-03-09 06:37 139264 ----a-w c:\windows\system32\viscomqtde.dll
2009-04-20 22:22 . 2009-04-20 22:22 -------- d-----w c:\program files\Plato Video To 3GP Converter
2009-04-20 22:17 . 2009-04-20 22:17 -------- d-----w c:\documents and settings\hamza\Local Settings\Application Data\Google
2009-04-20 22:16 . 2009-04-20 22:16 -------- d-----w c:\program files\USB Disk Security
2009-04-20 22:15 . 2009-04-20 22:15 -------- d-sh--w C:\Recycled
2009-04-20 22:11 . 2009-04-23 08:18 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-04-20 22:11 . 2009-04-20 22:11 -------- d-----w c:\program files\Common Files\Real
2009-04-20 22:11 . 2009-04-20 22:11 -------- d-----w c:\program files\Google
2009-04-20 22:11 . 2009-04-20 22:11 -------- d-----w c:\program files\Real
2009-04-20 22:08 . 2009-04-20 22:08 -------- d-----w c:\program files\GRETECH
2009-04-20 22:06 . 2009-04-20 22:06 -------- d-----w c:\documents and settings\hamza\Contacts
2009-04-20 22:04 . 2009-04-20 22:04 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2009-04-20 22:03 . 2009-04-20 22:03 -------- d-----w c:\program files\Yahoo!
2009-04-20 22:01 . 2009-04-20 22:01 -------- d-----w c:\program files\Windows Live
2009-04-20 21:46 . 2009-04-20 21:46 -------- d-----w c:\documents and settings\All Users\Application Data\Avira
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-21 07:04 . 2009-04-20 20:25 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-20 21:25 . 2009-04-20 21:25 5 ----a-w c:\windows\system32\drivers\DELL_INS_1525.MRK
2009-04-20 21:25 . 2009-04-20 21:25 5 ----a-w c:\windows\system32\drivers\1028_DELL_INS_1525.MRK
2009-04-20 21:14 . 2009-04-20 21:14 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_Apfiltr_01005.Wdf
2009-04-20 21:14 . 2009-04-20 21:14 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-04-20 21:14 . 2009-04-20 21:13 -------- d-----w c:\program files\DellTPad
2009-04-20 20:52 . 2009-04-20 20:52 -------- d-----w c:\program files\SigmaTel
2009-04-20 20:52 . 2009-04-20 20:52 -------- d-----w c:\program files\Common Files\InstallShield
2009-04-20 20:51 . 2009-04-20 20:51 -------- d-----w c:\program files\Dell
2009-04-20 20:43 . 2009-04-20 20:43 -------- d-----w c:\program files\Intel
2009-04-20 20:39 . 2009-04-20 20:39 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-20 20:26 . 2009-04-20 20:26 -------- d-----w c:\program files\microsoft frontpage
2009-04-20 20:25 . 2004-08-04 12:00 67 --sha-w c:\windows\Fonts\desktop.ini
2009-04-20 20:22 . 2009-04-20 20:22 21640 ----a-w c:\windows\system32\emptyregdb.dat
2009-03-06 15:00 . 2004-08-04 12:00 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-03 01:18 . 2007-01-14 05:20 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-21 05:25 . 2009-02-21 05:25 691592 ----a-w c:\windows\system32\OGACheckControl.DLL
2009-02-20 19:09 . 2004-08-04 12:00 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-09 11:01 . 2007-01-14 05:20 728576 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 11:01 . 2007-01-14 05:17 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 11:01 . 2004-08-04 12:00 617984 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 11:01 . 2004-08-04 12:00 715264 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 10:20 . 2007-01-14 05:16 1847424 ----a-w c:\windows\system32\win32k.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-08-16 5728112]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2006-11-30 4662776]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-04-21 932864]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-10-25 167936]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-12-10 1228800]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2008-06-12 266497]
"USB Antivirus"="c:\program files\USB Disk Security\USBGuard.exe" [2008-07-13 753664]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-23 185896]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-11-15 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-11-15 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-11-15 137752]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-05-09 36864]
"SDaemon"="c:\windows\sdaemon.exe" [2005-04-18 111104]
"SWd"="c:\windows\winwd.exe" [2005-04-18 26624]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-03 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-4-21 113664]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
R0 WINSEC;WINSEC;c:\windows\system32\drivers\winsec.sys [19/04/2005 12:57 ص 20352]
R1 pelmouse;Mouse Suite Driver;c:\windows\system32\drivers\PELMouse.SYS [24/04/2009 12:26 م 17408]
R2 antivirwebservice;Avira AntiVir Premium WebGuard;c:\program files\Avira\AntiVir PersonalEdition Premium\avwebgrd.exe [21/04/2009 12:46 ص 258305]
R2 AVEService;Avira AntiVir Premium MailGuard helper service;c:\program files\Avira\AntiVir PersonalEdition Premium\avesvc.exe [21/04/2009 12:46 ص 41217]
R2 winser;winser;c:\windows\system32\winsersec.exe [14/04/2005 01:37 ص 53248]
R2 yksvc;Marvell Yukon Service;c:\windows\System32\svchost.exe -k yksvcs [04/08/2004 03:00 م 14336]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [24/04/2009 09:29 ص 105984]
R3 OEM02Afx;Provides a software interface to control audio effects of OEM002 camera.;c:\windows\system32\drivers\OEM02Afx.sys [21/04/2009 12:13 ص 141376]
R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\system32\drivers\OEM02Dev.sys [21/04/2009 12:13 ص 235584]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\system32\drivers\OEM02Vfx.sys [21/04/2009 12:13 ص 7424]
R3 pelusblf;USB Mouse Low Filter Driver;c:\windows\system32\drivers\PELUSBLF.SYS [24/04/2009 12:26 م 9728]
R3 RTLWUSB;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [21/04/2009 12:39 ص 332928]
S2 AntiVirMailService;Avira AntiVir Premium MailGuard;c:\program files\Avira\AntiVir PersonalEdition Premium\avmailc.exe [21/04/2009 12:46 ص 164097]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [21/04/2009 03:36 م 216232]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
yksvcs REG_MULTI_SZ yksvc
.
- - - - ORPHANS REMOVED - - - -
BHO-{c95a4e8e-816d-4655-8c79-d736da1adb6d} - (no file)
HKLM-Run-Mouse Suite 98 Daemon - ico.EXE
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = local
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: ShaPlus Google Translator - c:\program files\ShaPlus Google Translator\GoogleTranslator.dll/ie.htm
IE: تحميل الكل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetVL.htm
LSP: c:\windows\system32\idmmbc.dll
LSP: avsda.dll
.
.
------- File Associations -------
.
txtfile=c:\windows\notepad.exe %1
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-07 14:43
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'lsass.exe'(1180)
c:\windows\system32\idmmbc.dll
c:\windows\system32\avsda.dll
.
Completion time: 2009-05-07 14:44
ComboFix-quarantined-files.txt 2009-05-07 11:44
Pre-Run: 20,545,552,384 bytes free
Post-Run: 20,792,721,408 bytes free
266 --- E O F --- 2009-04-24 16:14
