حياك الله عزيزي
هذا هو التقرير يالغـلا
---------------
ComboFix 09-05-12.06 - ma3 05/13/2009 18:56.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1256.966.1025.18.2045.1193 [GMT 3:00]
Running from: c:\users\ma3\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\users\ma3\AppData\Roaming\inst.exe
c:\windows\system32\kakle.dll
c:\windows\system32\winitn.dll
.
((((((((((((((((((((((((( Files Created from 2009-04-13 to 2009-05-13 )))))))))))))))))))))))))))))))
.
2009-05-12 22:40 . 2009-05-12 22:40 -------- d-----w c:\program files\Trend Micro
2009-05-12 20:25 . 2009-05-12 20:25 -------- d-----w c:\program files\Windows Live SkyDrive
2009-05-12 20:25 . 2009-05-12 20:25 -------- d-----w c:\program files\Windows Live
2009-05-12 20:17 . 2009-05-12 20:17 -------- d-----w c:\program files\Windows Installer Clean Up
2009-05-06 17:07 . 2009-05-06 17:07 -------- d-----w c:\windows\Downloaded Installations
2009-04-25 03:09 . 2009-04-25 03:09 -------- d-----w c:\users\ma3\AppData\Roaming\DivX
2009-04-25 03:07 . 2009-04-25 03:07 -------- d-----w c:\program files\Common Files\PX Storage Engine
2009-04-25 03:06 . 2009-04-25 03:06 -------- d-----w c:\program files\Common Files\DivX Shared
2009-04-25 03:06 . 2009-04-25 03:20 -------- d-----w c:\program files\DivX
2009-04-25 02:09 . 2009-04-25 02:00 241664 ----a-w c:\program files\Uninstall Ask Toolbar.dll
2009-04-25 02:07 . 2009-04-25 02:07 -------- d-----w c:\users\ma3\AppData\Roaming\HPAppData
2009-04-25 02:00 . 2009-04-25 02:00 -------- d-----w c:\program files\AskPBar
2009-04-17 21:29 . 2009-04-17 21:29 -------- d-----w c:\windows\Profiles
2009-04-17 21:25 . 2009-04-17 21:25 -------- d-----w c:\programdata\WLInstaller
2009-04-17 21:25 . 2009-04-17 21:25 -------- d-----w c:\users\All Users\WLInstaller
2009-04-17 14:27 . 2009-04-17 14:27 -------- d-----w c:\users\ma3\AppData\Roaming\URSoft
2009-04-17 14:27 . 2009-04-17 21:29 -------- d-----w c:\program files\Your Uninstaller 2008
2009-04-17 14:11 . 2009-05-12 20:16 -------- d-----w c:\program files\MSECACHE
2009-04-17 01:15 . 2008-12-06 04:42 376832 ----a-w c:\windows\system32\winhttp.dll
2009-04-17 01:15 . 2008-06-06 03:27 562176 ----a-w c:\windows\system32\msdtcprx.dll
2009-04-17 01:15 . 2008-06-06 03:27 38912 ----a-w c:\windows\system32\xolehlp.dll
2009-04-16 13:37 . 2009-04-16 13:37 -------- d-----w c:\users\ma3\AppData\Roaming\FairStars Audio Converter
2009-04-16 13:35 . 2009-04-16 13:35 -------- d-----w c:\program files\FairStars Audio Converter
2009-04-16 13:24 . 2009-04-16 13:29 5 ----a-w c:\windows\system32\SySRMAC.dat
2009-04-16 13:24 . 2009-04-16 13:24 -------- d-----w c:\program files\HiFisoftware
2009-04-15 20:24 . 2009-04-15 20:24 90112 ----a-w c:\windows\system32\dpl100.dll
2009-04-15 20:24 . 2009-04-15 20:24 684032 ----a-w c:\windows\system32\DivX.dll
2009-04-15 20:24 . 2009-04-15 20:24 823296 ----a-w c:\windows\system32\divx_xx07.dll
2009-04-15 20:24 . 2009-04-15 20:24 815104 ----a-w c:\windows\system32\divx_xx0a.dll
2009-04-15 20:24 . 2009-04-15 20:24 823296 ----a-w c:\windows\system32\divx_xx0c.dll
2009-04-15 20:24 . 2009-04-15 20:24 802816 ----a-w c:\windows\system32\divx_xx11.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-13 15:54 . 2008-08-26 06:50 78240 ----a-w c:\windows\system32\perfc001.dat
2009-05-13 15:54 . 2008-08-26 06:50 438948 ----a-w c:\windows\system32\perfh001.dat
2009-05-12 22:49 . 2009-03-03 22:57 712736 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-12 22:49 . 2009-03-03 22:57 5612 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-12 22:49 . 2009-03-03 22:57 4239904 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-12 22:49 . 2009-03-03 22:57 37348 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-12 20:30 . 2009-03-03 22:18 -------- d-----w c:\program files\Messenger Plus! Live
2009-05-06 16:59 . 2009-03-03 18:42 124128 ----a-w c:\users\ma3\AppData\Local\GDIPFONTCACHEV1.DAT
2009-05-06 16:44 . 2009-03-07 19:53 -------- d-----w c:\program files\Microsoft Works
2009-04-25 03:54 . 2009-03-06 10:16 -------- d-----w c:\program files\Allok Video to DVD Burner
2009-04-17 13:55 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail
2009-04-17 13:42 . 2009-03-09 22:19 -------- d-----w c:\program files\Common Files\DVDVideoSoft
2009-04-13 20:32 . 2009-03-14 00:25 -------- d-----w c:\program files\Power MP3 Cutter
2009-04-13 20:32 . 2009-03-14 01:01 -------- d-----w c:\program files\Power Mp3 Cutter(Mp3 Sound Cutter)
2009-04-01 22:31 . 2009-04-01 22:31 56 ---ha-w c:\users\All Users\ezsidmv.dat
2009-04-01 22:31 . 2009-04-01 22:31 56 ---ha-w c:\programdata\ezsidmv.dat
2009-04-01 22:27 . 2009-04-01 22:27 -------- d-----w c:\program files\Common Files\Skype
2009-04-01 22:27 . 2009-04-01 22:27 -------- d-----r c:\program files\Skype
2009-03-25 01:18 . 2009-03-25 01:08 -------- d-----w c:\program files\Easy Video Splitter
2009-03-25 00:59 . 2009-03-25 00:59 -------- d-----w c:\program files\WMV9_VCM
2009-03-21 01:48 . 2006-11-02 10:25 86016 ----a-w c:\windows\inf\infstor.dat
2009-03-21 01:48 . 2006-11-02 10:25 51200 ----a-w c:\windows\inf\infpub.dat
2009-03-21 01:48 . 2006-11-02 10:25 143360 ----a-w c:\windows\inf\infstrng.dat
2009-03-21 01:40 . 2009-03-21 01:40 2232 ----a-w c:\windows\Java\Packages\Data\2QPVDZDB.DAT
2009-03-21 01:40 . 2009-03-21 01:40 155995 ----a-w c:\windows\Java\Packages\MQ4SPZ1F.ZIP
2009-03-21 01:40 . 2009-03-21 01:40 2678 ----a-w c:\windows\Java\Packages\Data\3B1JJRFP.DAT
2009-03-21 01:40 . 2009-03-21 01:40 2678 ----a-w c:\windows\Java\Packages\Data\971Z9FR7.DAT
2009-03-21 01:40 . 2009-03-21 01:40 2678 ----a-w c:\windows\Java\Packages\Data\21RBHJ3N.DAT
2009-03-21 01:40 . 2009-03-21 01:40 2678 ----a-w c:\windows\Java\Packages\Data\
0E2OPBHR.DAT
2009-03-21 01:40 . 2009-03-21 01:40 2678 ----a-w c:\windows\Java\Packages\Data\5B1N9FNX.DAT
2009-03-17 20:54 . 2009-03-17 20:54 -------- d-----w c:\program files\mpegable
2009-03-17 20:54 . 2009-03-17 20:54 47104 ------w c:\windows\AKDeInstall.exe
2009-03-17 03:38 . 2009-04-17 01:14 13824 ----a-w c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-17 01:14 24064 ----a-w c:\windows\system32\amxread.dll
2009-03-08 14:10 . 2009-03-07 13:27 98304 ----a-w c:\windows\system32\viscomtran.dll
2009-03-08 11:34 . 2009-05-06 16:38 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 11:34 . 2009-05-06 16:38 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 11:33 . 2009-05-06 16:38 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 11:33 . 2009-05-06 16:38 109056 ----a-w c:\windows\system32\iesysprep.dll
2009-03-08 11:33 . 2009-05-06 16:38 109568 ----a-w c:\windows\system32\PDMSetup.exe
2009-03-08 11:33 . 2009-05-06 16:38 132608 ----a-w c:\windows\system32\ieUnatt.exe
2009-03-08 11:33 . 2009-05-06 16:38 107520 ----a-w c:\windows\system32\RegisterIEPKEYs.exe
2009-03-08 11:33 . 2009-05-06 16:38 107008 ----a-w c:\windows\system32\SetIEInstalledDate.exe
2009-03-08 11:33 . 2009-05-06 16:38 103936 ----a-w c:\windows\system32\SetDepNx.exe
2009-03-08 11:33 . 2009-05-06 16:38 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 11:32 . 2009-05-06 16:38 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 11:32 . 2009-05-06 16:38 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 11:32 . 2009-05-06 16:38 66560 ----a-w c:\windows\system32\wextract.exe
2009-03-08 11:32 . 2009-05-06 16:38 169472 ----a-w c:\windows\system32\iexpress.exe
2009-03-08 11:31 . 2009-05-06 16:38 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 11:31 . 2009-05-06 16:38 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 11:31 . 2009-05-06 16:38 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 11:22 . 2009-05-06 16:38 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 10:11 . 2009-03-06 08:17 47360 ----a-w c:\users\ma3\AppData\Roaming\pcouffin.sys
2009-03-06 08:17 . 2009-03-06 08:17 47360 ----a-w c:\windows\system32\drivers\pcouffin.sys
2009-03-05 18:05 . 2009-03-05 17:46 173310 ----a-w c:\windows\hphins26.dat
2009-03-03 23:10 . 2008-01-29 14:29 33808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-03-03 23:10 . 2009-03-03 22:58 89601 ----a-w c:\windows\system32\drivers\klick.dat
2009-03-03 23:10 . 2009-03-03 22:58 101287 ----a-w c:\windows\system32\drivers\klin.dat
2009-03-03 20:53 . 2009-03-03 20:53 680 ----a-w c:\users\ma3\AppData\Local\d3d9caps.dat
2009-03-03 04:46 . 2009-04-17 01:14 3599328 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-03-03 04:46 . 2009-04-17 01:14 3547632 ----a-w c:\windows\system32\ntoskrnl.exe
2009-03-03 04:39 . 2009-04-17 01:14 183296 ----a-w c:\windows\system32\sdohlp.dll
2009-03-03 04:39 . 2009-04-17 01:14 551424 ----a-w c:\windows\system32\rpcss.dll
2009-03-03 04:39 . 2009-04-17 01:14 26112 ----a-w c:\windows\system32\printfilterpipelineprxy.dll
2009-03-03 04:37 . 2009-04-17 01:14 98304 ----a-w c:\windows\system32\iasrecst.dll
2009-03-03 04:37 . 2009-04-17 01:14 54784 ----a-w c:\windows\system32\iasads.dll
2009-03-03 04:37 . 2009-04-17 01:14 44032 ----a-w c:\windows\system32\iasdatastore.dll
2009-03-03 03:04 . 2009-04-17 01:14 666624 ----a-w c:\windows\system32\printfilterpipelinesvc.exe
2009-03-03 02:38 . 2009-04-17 01:14 17408 ----a-w c:\windows\system32\iashost.exe
2009-02-21 05:25 . 2009-02-21 05:25 691592 ----a-w c:\windows\system32\OGACheckControl.DLL
2009-02-13 08:49 . 2009-04-17 01:14 72704 ----a-w c:\windows\system32\secur32.dll
2009-02-13 08:49 . 2009-04-17 01:14 1255936 ----a-w c:\windows\system32\lsasrv.dll
2008-01-21 02:57 . 2006-11-02 12:48 174 --sha-w c:\program files\desktop.ini
2008-08-26 06:59 . 2008-08-26 06:59 8192 --sha-w c:\windows\Users\Default\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"balm grid"="c:\programdata\License Support Support.p84fz" [X]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 1449984]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2008-10-28 2606512]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-03-27 24103720]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"balm grid"="c:\programdata\License Support Support.0aa5b" [X]
"style cool 2 city"="c:\programdata\Download Win Idle.57jwkqz" [X]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-02 75008]
"DPService"="c:\program files\HP\DVDPlay\DPService.exe" [2008-06-11 90112]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_01\bin\jusched.exe" [2007-04-06 132760]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-03-03 206088]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-03 198160]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd.dll c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~1\adialhk.dll c:\progra~1\KASPER~1\KASPER~1\kloehk.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{F34D9733-69D3-434A-863F-75135B4325BC}"= c:\program files\HP\DVDPlay\DVDPlay.exe
VD Play
"{8AC7D1D8-F6EC-4372-BB78-082DF5B5C2FD}"= c:\program files\HP\DVDPlay\DPService.exe
VD Play Resident Program
"{B717D899-3589-4F77-895A-557EDC590853}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{83A01AC1-D4EE-426E-8914-96036D5C0C42}"= Disabled:UDP:c:\program files\HP\Digital Imaging\bin\hpqtra08.exe:hpqtra08.exe
"{5319D642-5B10-4BC5-84FB-2294F41441F1}"= Disabled:TCP:c:\program files\HP\Digital Imaging\bin\hpqtra08.exe:hpqtra08.exe
"{B20AA0C9-3638-43F5-AC72-880CA176FD39}"= Disabled:UDP:c:\program files\HP\Digital Imaging\bin\hpqste08.exe:hpqste08.exe
"{FF9573ED-16A6-44C7-AF98-7DA176185A9A}"= Disabled:TCP:c:\program files\HP\Digital Imaging\bin\hpqste08.exe:hpqste08.exe
"{8F9AB08C-178D-4BFA-9710-DE5C39D074C4}"= Disabled:UDP:c:\program files\HP\Digital Imaging\bin\hposid01.exe:hposid01.exe
"{F8F597A1-9EE1-48DD-A023-A3835E12B6C4}"= Disabled:TCP:c:\program files\HP\Digital Imaging\bin\hposid01.exe:hposid01.exe
"{98B547AF-3AA9-48F6-8964-91F3714CA032}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{507EEF39-9063-4E1B-9206-634A611BF5B7}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{537405EA-3753-4816-809C-B5CC1D6E5DA4}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{849E1744-E685-4D9B-AB84-F7DF76A60957}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{B96301A3-68B2-4B9F-ADC9-4D1FB21D6ED9}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{1F624CC8-BCDA-40E3-9FAA-DD39758FF1C3}"= c:\program files\Skype\Phone\Skype.exe:Skype
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
"DoNotAllowExceptions"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\River Past\\Video Slice\\VideoSlice.exe"= c:\program files\River Past\Video Slice\VideoSlice.exe:*:Enabled:River Past Video Slice
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\System32\drivers\klbg.sys [1/29/2008 05:29 م 33808]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\System32\drivers\klim6.sys [7/9/2008 05:28 م 20496]
R3 HSXHWBS3;HSXHWBS3;c:\windows\System32\drivers\HSXHWBS3.sys [8/26/2008 10:00 ص 207360]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\System32\drivers\klfltdev.sys [3/13/2008 06:02 م 26640]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2100d471-285f-11de-b44c-002185650d52}]
\Shell\aUTopLAy\cOmmaND - ktxv.exe
\Shell\AutoRun\command - ktxv.exe
\Shell\exPLorE\cOmMand - ktxv.exe
\Shell\open\commaNd - ktxv.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f28970ef-1c7e-11de-b6ff-002185650d52}]
\shell\AutoRun\command - WDSetup.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-05-13 c:\windows\Tasks\User_Feed_Synchronization-{4D7EFAFA-02F3-4B75-B707-F9CECBBE7BB9}.job
- c:\windows\system32\msfeedssync.exe [2009-05-06 11:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=ar_sa&c=84&bd=Presario&pf=cndt
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: تحميل الكل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetVL.htm
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-13 19:00
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1838115890-4244154814-1892963935-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):5d,e4,e2,54,28,8d,7c,75,de,6f,00,50,0a,1b,41,b1,d0,ac,09,3f,1d,
0e,c4,c4,9c,8b,02,f8,c2,36,a2,5b,ce,60,74,90,a4,5e,3b,c7,00,00,00,00,00,00,\
[HKEY_USERS\S-1-5-21-1838115890-4244154814-1892963935-1000_Classes\CLSID\{c51f5378-aed8-4a56-8c46-1053bbba24a2}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:00000082
"Therad"=dword:0000000a
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,40,98,4f,b4,1e,23,78,1d,42,00,01,82,11,6e,de,f1,10,fc,c2,a1,b1,5b,\
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-05-13 19:01
ComboFix-quarantined-files.txt 2009-05-13 16:01
Pre-Run: 150,467,616,768 bytes free
Post-Run: 150,553,051,136 bytes free
260 --- E O F --- 2009-05-11 16:55
------------------
