هذا التقرير أخوي...
ComboFix 09-05-07.A01 - Administrator 05/08/2009 18:59.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.218.1033.18.2047.1303 [GMT 3:00]
Running from: c:\documents and settings\Administrator\My Documents\Downloads\Programs\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\Solt Lake Software
c:\windows\system32\_000110_.tmp.dll
c:\windows\system32\52QWLrdF.exe.a_a
c:\windows\system32\kakle.dll
c:\windows\system32\winitn.dll
c:\windows\system32\xwpkkyflrenywhj.dll
.
((((((((((((((((((((((((( Files Created from 2009-04-08 to 2009-05-08 )))))))))))))))))))))))))))))))
.
2009-05-08 14:04 . 2009-05-08 14:04 0 ----a-w c:\windows\system32\drivers\IsDrv118.sys
2009-05-08 14:04 . 2009-05-08 14:04 0 ----a-w c:\windows\system32\drivers\IsPubDrv.sys
2009-05-08 14:02 . 2009-05-08 14:02 107520 ----a-w c:\windows\Netfathr.exe
2009-05-08 14:02 . 2009-05-08 14:07 -------- d-sh--r d:\program files.\tuEagles
2009-05-07 15:21 . 2009-05-07 15:21 -------- d-----w d:\program files.\microsoft frontpage
2009-05-07 15:13 . 2009-05-07 15:13 -------- d-----w c:\documents and settings\Administrator\Application Data\Uniblue
2009-05-07 15:12 . 2009-05-07 20:45 -------- dc-h--w c:\documents and settings\All Users\Application Data\~0
2009-05-07 15:09 . 1998-06-17 22:00 153600 ----a-w c:\windows\system32\tlbinf32.dll
2009-05-05 11:31 . 2001-08-17 19:36 8192 -c--a-w c:\windows\system32\dllcache\kbdkor.dll
2009-05-05 11:31 . 2001-08-17 19:36 8192 ----a-w c:\windows\system32\kbdkor.dll
2009-05-05 11:31 . 2001-08-17 19:36 8704 -c--a-w c:\windows\system32\dllcache\kbdjpn.dll
2009-05-05 11:31 . 2001-08-17 19:36 8704 ----a-w c:\windows\system32\kbdjpn.dll
2009-05-05 11:31 . 2001-08-17 11:55 5632 -c--a-w c:\windows\system32\dllcache\kbd103.dll
2009-05-05 11:31 . 2001-08-17 11:55 5632 ----a-w c:\windows\system32\kbd103.dll
2009-05-05 11:31 . 2001-08-17 11:55 6144 -c--a-w c:\windows\system32\dllcache\kbd101c.dll
2009-05-05 11:31 . 2001-08-17 11:55 6144 ----a-w c:\windows\system32\kbd101c.dll
2009-05-05 11:31 . 2001-08-17 11:55 6144 -c--a-w c:\windows\system32\dllcache\kbd101b.dll
2009-05-05 11:31 . 2001-08-17 11:55 6144 ----a-w c:\windows\system32\kbd101b.dll
2009-05-05 11:31 . 2008-04-14 02:39 6144 -c--a-w c:\windows\system32\dllcache\kbd106.dll
2009-05-05 11:31 . 2008-04-14 02:39 6144 ----a-w c:\windows\system32\kbd106.dll
2009-05-05 07:49 . 2009-05-05 07:49 -------- d-----w c:\documents and settings\Administrator\Application Data\Netscape
2009-05-05 07:48 . 2009-05-05 07:48 -------- d-----w d:\program files.\Photodex
2009-05-05 07:48 . 2009-05-05 07:48 -------- d-----w c:\documents and settings\Administrator\Application Data\Photodex
2009-05-03 22:16 . 2009-05-03 22:16 214 ----a-w C:\UnInstall.dat
2009-05-03 22:16 . 2009-05-02 09:39 16896 ----a-w c:\windows\system32\grwinsthlp.exe
2009-05-01 12:11 . 2009-05-01 12:11 -------- d-----w c:\documents and settings\All Users\Application Data\Adobe Systems
2009-05-01 10:13 . 2009-05-01 10:13 -------- d-----w c:\documents and settings\Administrator\Application Data\GlarySoft
2009-04-30 09:35 . 2009-04-30 09:35 603904 ----a-w c:\windows\system32\TUProgSt.exe
2009-04-30 09:35 . 2008-11-24 11:19 27904 ----a-w c:\windows\system32\uxtuneup.dll
2009-04-30 09:35 . 2009-04-30 09:35 362240 ----a-w c:\windows\system32\TuneUpDefragService.exe
2009-04-29 21:19 . 2009-04-29 21:19 41808 ----a-w c:\windows\system32\xfcodec.dll
2009-04-29 19:35 . 2009-04-29 19:35 -------- d-----w c:\documents and settings\All Users\Application Data\PC Suite
2009-04-29 19:29 . 2009-04-29 19:35 -------- d-----w c:\documents and settings\Administrator\Application Data\PC Suite
2009-04-29 18:42 . 2009-04-29 18:42 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-04-29 14:19 . 2009-05-05 15:47 -------- d-----w c:\windows\system32\SupportWimax
2009-04-28 13:15 . 2009-04-29 18:42 -------- d-----w c:\documents and settings\Administrator\Application Data\CoreFTP
2009-04-17 14:47 . 2009-03-09 13:27 1846632 ----a-w c:\windows\system32\D3DCompiler_41.dll
2009-04-17 14:47 . 2009-03-09 13:27 453456 ----a-w c:\windows\system32\d3dx10_41.dll
2009-04-17 14:47 . 2009-03-09 13:27 4178264 ----a-w c:\windows\system32\D3DX9_41.dll
2009-04-17 14:47 . 2009-03-16 12:18 69448 ----a-w c:\windows\system32\XAPOFX1_3.dll
2009-04-17 14:47 . 2009-03-16 12:18 517448 ----a-w c:\windows\system32\XAudio2_4.dll
2009-04-17 14:47 . 2009-03-16 12:18 235352 ----a-w c:\windows\system32\xactengine3_4.dll
2009-04-17 14:47 . 2009-03-16 12:18 22360 ----a-w c:\windows\system32\X3DAudio1_6.dll
2009-04-15 10:28 . 2009-04-22 22:03 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Dyyno
2009-04-12 17:19 . 2009-04-12 17:19 -------- d-----w c:\program files\Common Files\xing shared
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-08 15:54 . 2009-01-18 14:10 189072 ----a-w c:\windows\system32\PnkBstrB.exe
2009-05-08 15:49 . 2009-01-18 14:10 138920 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-05-07 15:20 . 2009-01-26 10:42 688160 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-07 15:20 . 2009-01-26 10:42 4480 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-07 15:20 . 2009-01-26 10:42 2748960 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-07 15:20 . 2009-01-26 10:42 23604 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-07 15:20 . 2009-01-17 17:07 731528 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-05-07 14:52 . 2008-11-14 22:27 33712 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-03 10:58 . 2009-01-24 11:26 1324 ----a-w c:\windows\system32\d3d9caps.dat
2009-05-01 12:14 . 2009-02-18 14:33 -------- d-----w c:\program files\Common Files\Adobe
2009-04-26 20:52 . 2009-02-17 14:50 196608 ----a-w c:\windows\system32\maag.dll
2009-04-26 20:52 . 2009-02-17 14:50 1212416 ----a-w c:\windows\system32\ckll.dll
2009-04-26 20:52 . 2009-02-17 14:50 90112 ----a-w c:\windows\system32\agsaami.dll
2009-04-26 20:52 . 2009-02-17 14:50 610304 ----a-w c:\windows\system32\agsaamg.dll
2009-04-26 20:52 . 2009-02-17 14:50 372736 ----a-w c:\windows\system32\agsaamc.dll
2009-04-26 20:52 . 2009-02-17 14:50 2535424 ----a-w c:\windows\system32\agsaamj.dll
2009-04-26 20:52 . 2009-02-17 14:50 1986560 ----a-w c:\windows\system32\akll.dll
2009-04-26 20:52 . 2009-02-17 14:50 1245184 ----a-w c:\windows\system32\bkll.dll
2009-04-12 17:18 . 2008-11-14 14:23 -------- d-----w c:\program files\Common Files\Real
2009-04-07 10:44 . 2008-04-14 12:00 218624 ----a-w c:\windows\system32\uxtheme.dll
2009-03-25 15:28 . 2009-03-10 12:21 -------- d-----w c:\program files\Common Files\Ahead
2009-03-21 17:26 . 2009-01-18 14:10 139152 ----a-w c:\documents and settings\Administrator\Application Data\PnkBstrK.sys
2009-03-21 17:24 . 2009-03-21 17:06 111928 ----a-w c:\documents and settings\Administrator\Application Data\PnkBstrB.exe
2009-03-21 17:24 . 2009-01-26 10:29 794408 ----a-w c:\windows\system32\pbsvc.exe
2009-03-21 13:57 . 2008-09-12 11:42 -------- d-----w d:\program files.\SCC-TDS
2009-03-16 23:18 . 2009-03-16 23:18 -------- d-----w d:\program files.\GRETECH
2009-02-28 18:50 . 2009-02-28 18:50 2678 ----a-w c:\windows\java\Packages\Data\SNZ1R39J.DAT
2009-02-28 18:50 . 2009-02-28 18:50 2678 ----a-w c:\windows\java\Packages\Data\3BJV9B1F.DAT
2009-02-28 18:50 . 2009-02-28 18:50 2678 ----a-w c:\windows\java\Packages\Data\Q4C7BL7H.DAT
2009-02-28 18:50 . 2009-02-28 18:50 2678 ----a-w c:\windows\java\Packages\Data\GRBHFRRV.DAT
2009-02-28 18:50 . 2009-02-28 18:50 2678 ----a-w c:\windows\java\Packages\Data\XRR77LVD.DAT
2009-02-28 18:44 . 2009-02-28 18:44 2232 ----a-w c:\windows\java\Packages\Data\9BR713VB.DAT
2009-02-28 18:44 . 2009-02-28 18:44 155995 ----a-w c:\windows\java\Packages\NZ7DBVLF.ZIP
2009-02-28 09:02 . 2009-01-18 14:10 75064 ----a-w c:\windows\system32\PnkBstrA.exe
2009-02-27 06:03 . 2008-12-06 18:13 57394 ----a-w c:\windows\system32\xwpkkyflrenywhj.dll-uninst.exe
2009-02-18 20:10 . 2001-08-23 12:00 67 --sha-w c:\windows\Fonts\desktop.ini
2009-02-18 20:08 . 2008-11-14 13:29 23224 ----a-w c:\windows\system32\emptyregdb.dat
2009-02-17 14:50 . 2009-02-17 14:50 344064 ----a-w c:\windows\system32\dkll.dll
2009-02-10 09:22 . 2008-01-29 15:29 33808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-02-10 09:21 . 2009-01-26 10:43 89601 ----a-w c:\windows\system32\drivers\klick.dat
2009-02-10 09:21 . 2009-01-26 10:43 101287 ----a-w c:\windows\system32\drivers\klin.dat
.
------- Sigcheck -------
[-] 2008-08-20 05:33 667648 C91E3A6EF094202F6B5CA8960DFCF243 c:\windows\$hf_mig$\KB956390\SP2QFE\wininet.dll
[-] 2008-08-20 05:30 666112 9AF5F25124FBDC36E2B510729CBA2674 c:\windows\$hf_mig$\KB956390\SP3GDR\wininet.dll
[-] 2008-08-20 04:58 666624 94418F53D2612C26DBADC04DAFBC197C c:\windows\$hf_mig$\KB956390\SP3QFE\wininet.dll
[7] 2008-04-14 00:12 666112 7A4F775ABB2F1C97DEF3E73AFA2FAEDD c:\windows\$NtUninstallKB956390$\wininet.dll
[-] 2004-08-03 22:56 656384 C0823FC5469663BA63E7DB88F9919D70 c:\windows\$NtUninstallKB956390_0$\wininet.dll
[7] 2008-04-14 12:00 666112 7A4F775ABB2F1C97DEF3E73AFA2FAEDD c:\windows\NiwradSoft Shell Pack\Backup\wininet.dll
[-] 2008-10-16 10:37 659456 6F1E4BFD78C4E0D05FF3725D59B72925 c:\windows\SoftwareDistribution\Download\7bc58354ca50aa200544caaef7677c8a\SP2GDR\wininet.dll
[-] 2008-10-16 10:20 667648 93C9D0A216498EE14EB9B26119BB95EE c:\windows\SoftwareDistribution\Download\7bc58354ca50aa200544caaef7677c8a\SP2QFE\wininet.dll
[-] 2008-10-16 01:00 666112 1576318BF08D28CC61D1278114AD8D5B c:\windows\SoftwareDistribution\Download\7bc58354ca50aa200544caaef7677c8a\SP3GDR\wininet.dll
[-] 2008-10-16 01:04 667136 E8FCE58A470999350F64C591557F9E42 c:\windows\SoftwareDistribution\Download\7bc58354ca50aa200544caaef7677c8a\SP3QFE\wininet.dll
[-] 2008-04-14 12:00 776192 966F311363CE6E4719A0A04070D345CC c:\windows\system32\wininet.dll
[-] 2008-04-14 12:00 776192 966F311363CE6E4719A0A04070D345CC c:\windows\system32\dllcache\wininet.dll
[-] 2008-08-14 09:18 2062976 63EC865DFF6CCFC7BEF94B5C50297CAD c:\windows\$hf_mig$\KB956841\SP2QFE\ntkrnlpa.exe
[-] 2008-08-14 09:33 2066048 4AC58F03EB94A72809949D757FC39D80 c:\windows\$hf_mig$\KB956841\SP3GDR\ntkrnlpa.exe
[-] 2008-08-14 13:39 2066048 A25E9B86EFFB2AF33BF51E676B68BFB0 c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
[7] 2008-04-13 18:31 2023936 7F653A89F6E89E3AE0D49830EECE35D4 c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe
[-] 2004-08-03 23:05 2015232 FB142B7007CA2EEA76966C6C5CC12150 c:\windows\$NtUninstallKB956841_0$\ntkrnlpa.exe
[7] 2008-04-14 12:00 2023936 7F653A89F6E89E3AE0D49830EECE35D4 c:\windows\NiwradSoft Shell Pack\Backup\ntkrnlpa.exe
[-] 2008-04-14 12:00 2186752 E79A41C2F9EAC01B23A18C8911112934 c:\windows\system32\ntkrnlpa.exe
[-] 2008-08-14 09:57 2185984 CE69DBD54221F2D40E49FF6DB77C6507 c:\windows\$hf_mig$\KB956841\SP2QFE\ntoskrnl.exe
[-] 2008-08-14 10:11 2189184 EEAF32F8E15A24F62BECB1BD403BB5C5 c:\windows\$hf_mig$\KB956841\SP3GDR\ntoskrnl.exe
[-] 2008-08-14 14:11 2189184 31914172342BFF330063F343AC6958FE c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
[7] 2008-04-13 19:24 2145280 40F8880122A030A7E9E1FEDEA833B33D c:\windows\$NtUninstallKB956841$\ntoskrnl.exe
[-] 2004-08-03 21:18 2148352 626309040459C3915997EF98EC1C8D40 c:\windows\$NtUninstallKB956841_0$\ntoskrnl.exe
[7] 2008-04-14 12:00 2145280 40F8880122A030A7E9E1FEDEA833B33D c:\windows\NiwradSoft Shell Pack\Backup\ntoskrnl.exe
[-] 2008-04-14 12:00 2308096 33C3C3D7A7C6E56D9EBC3E8EEA0D490C c:\windows\system32\ntoskrnl.exe
[-] 2008-04-14 12:00 1540608 891CC147CC1EAA759A7DA3050E7446FF c:\windows\explorer.exe
[7] 2008-04-14 12:00 1033728 12896823FB95BFB3DC9B46BCAEDC9923 c:\windows\NiwradSoft Shell Pack\Backup\explorer.exe
[-] 2008-04-14 12:00 1540608 891CC147CC1EAA759A7DA3050E7446FF c:\windows\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-02-24 2745776]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"RGSC"="d:\grand theft auto iv\Rockstar Games Social Club\RGSCLauncher.exe" [2009-01-26 306088]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"WinSys2"="c:\windows\system32\winsys2.exe" [2006-04-29 208896]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-12 198160]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-10 206088]
"eagleeye"="d:\program files.\tuEagles\EagleSvr.exe" [2009-05-08 408064]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-10-07 1630208]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2007-10-12 577536]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"RGSC"=d:\grand theft auto iv\Rockstar Games Social Club\RGSCLauncher.exe /silent
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Mozilla Firefox 3 Beta 2\\firefox.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Grand Theft Auto IV\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"d:\\Program Files\\Grand Theft Auto IV\\Grand Theft Auto IV\\GTAIV.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program Files\\SCC-TDS\\Command And Conquer Red Alert 3\\Data\\ra3_1.0.game"=
"d:\\Program Files\\SCC-TDS\\Command And Conquer Red Alert 3\\Data\\ra3_1.8.game"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\SCC-TDS\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"d:\\Program Files\\tuEagles\\EagleSvr.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 06:29 م 33808]
R3 AVHybrid;AVHybrid service;c:\windows\system32\drivers\AVHybrid.sys [01/07/2005 01:01 م 999808]
R3 HuaweiWiMAXUSB;HuaweiWiMAXUSB Device driver;c:\windows\system32\drivers\HuaweiWiMAXUSB.sys [15/02/2009 06:11 م 45312]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 07:02 م 26640]
S2 gupdate1c9ad443d76c006;gupdate1c9ad443d76c006; [x]
S2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [30/04/2009 12:35 م 603904]
S3 dump_wmimmc;dump_wmimmc; [x]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [17/01/2009 08:30 م 138112]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - PNKBSTRB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2580971e-fa0c-11dd-9851-00192103c7f1}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Iloveher.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2580971f-fa0c-11dd-9851-00192103c7f1}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Iloveher.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2a0059fb-09b0-11de-9882-001e108547de}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Iloveher.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3d711291-131d-11de-9898-001e108547de}]
\sheLl\aUTopLAY\command - G:\ejojut.cmd
\sheLl\AutoRun\command - G:\ejojut.cmd
\sheLl\EXPlOrE\command - G:\ejojut.cmd
\sheLl\open\CommanD - G:\ejojut.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5fdae04b-0991-11de-9880-001e108547de}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Iloveher.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bb4484ba-fb72-11dd-9856-00192103c7f1}]
\Shell\AutoRun\command - F:\StarSetup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bb4484bc-fb72-11dd-9856-00192103c7f1}]
\Shell\AutoRun\command - F:\StarSetup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bc723867-04fe-11de-9879-001e108547de}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Iloveher.exe
.
Contents of the 'Scheduled Tasks' folder
2009-05-08 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-04 14:46]
2009-05-08 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-25 12:21]
.
- - - - ORPHANS REMOVED - - - -
BHO-{6BAAFB29-2F6C-DA4D-18D5-15E027AB712D} - c:\windows\system32\xwpkkyflrenywhj.dll
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.ly/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*
http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*
http://www.yahoo.com
IE: ????? ???? ?????? Internet Download Manager
IE: ????? ????? FLV ?????? Internet Download Manager
IE: ????? ?????? Internet Download Manager
IE: E???? ??E?? FLV E?C??E Internet Download Manager
IE: E???? C??? E?C??E Internet Download Manager
IE: E???? E?C??E Internet Download Manager
IE: E???? ??E?? FLV E?C??E Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
IE: E???? C??? E?C??E Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: E???? E?C??E Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5p85lj9u.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - component: c:\documents and settings\Administrator\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\plugins\npPxPlay.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 2\plugins\npyaxmpb.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprpjplug.dll
FF - plugin: c:\program files\Windows Media Player\npdrmv2.dll
FF - plugin: c:\program files\Windows Media Player\npdsplay.dll
FF - plugin: c:\program files\Windows Media Player\npwmsdrm.dll
FF - plugin: c:\program files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2009-05-08 19:01
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1123561945-507921405-839522115-500\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A06499A1-6085-6B7F-20CC-56C457CDF178}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"abddpdbalnahnikphehnkjkbdkbccmnggi"=hex:65,62,64,69,6a,6e,6c,69,6f,6a,63,6a,
6a,68,63,62,6b,6b,67,6d,64,69,65,6e,69,6f,66,70,6d,6d,6c,67,6a,69,6c,67,61,\
"bbddpdbalnahnikpheinfmkbhgiplpimghbm"=hex:61,62,61,6e,68,68,70,6a,66,6d,6b,64,
68,6f,6c,66,6e,6d,64,62,6d,62,61,66,65,6c,6a,6c,6e,6f,70,62,63,6c,00,67
[HKEY_USERS\S-1-5-21-1123561945-507921405-839522115-500\Software\SecuROM\License information*]
"datasecu"=hex:bb,b8,83,90,b8,72,38,c1,27,8e,2e,42,af,5e,2d,ce,56,e0,ec,bc,98,
4b,1d,8a,4d,db,33,6f,cd,52,36,a3,87,01,26,a1,7b,45,64,8d,50,10,f0,b0,33,89,\
"rkeysecu"=hex:05,9e,b5,be,ee,ec,f5,be,e6,52,11,bb,37,ca,ad,1b
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):a0,a9,1a,94,41,1e,73,47,e4,9a,a7,b0,df,bb,19,d4,f8,10,bb,40,73,
ce,7b,2b,87,f1,5c,eb,fa,ce,60,7e,a5,ae,4a,28,bd,af,57,c7,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{f570ca31-d385-4921-90ab-5ce0648933f2}]
@Denied: (Full) (Everyone)
"Model"=dword:0000003d
"Therad"=dword:0000000f
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,98,07,ff,fc,5d,
df,1c,2f,3b,8a,0a,32,11,89,01,b5,f6,31,ec,ed,75,f3,b6,1d,5d,f0,c9,49,d3,6c,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1396)
c:\windows\system32\SETUPAPI.dll
- - - - - - - > 'lsass.exe'(1496)
c:\windows\system32\setupapi.dll
.
Completion time: 2009-05-08 19:02
ComboFix-quarantined-files.txt 2009-05-08 16:02
Pre-Run: 2,968,981,504 bytes free
Post-Run: 2,980,868,096 bytes free
308 --- E O F --- 2009-01-26 14:28
