ComboFix 09-05-20.05 - MAS 05/21/2009 0:18.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1033.18.1013.550 [GMT 3:00]
Running from: c:\documents and settings\MAS\My Documents\Downloads\Programs\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\IE4 Error Log.txt
c:\windows\system32\kakle.dll
.
((((((((((((((((((((((((( Files Created from 2009-04-20 to 2009-05-20 )))))))))))))))))))))))))))))))
.
2009-05-18 20:51 . 2009-05-18 20:52 -------- dc-h--w c:\windows\ie8
2009-05-16 16:22 . 2009-05-16 17:39 -------- d-----w c:\windows\system32\drivers\imon
2009-05-16 12:25 . 2009-05-16 12:25 -------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-05-16 12:25 . 2009-05-16 12:25 -------- d-----w c:\program files\SUPERAntiSpyware
2009-05-16 12:25 . 2009-05-16 12:25 -------- d-----w c:\documents and settings\MAS\Application Data\SUPERAntiSpyware.com
2009-05-16 12:23 . 2009-05-16 12:23 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-05-16 10:33 . 2009-05-16 11:01 101287 ----a-w c:\windows\system32\drivers\klin.dat
2009-05-16 10:33 . 2009-05-16 11:01 89601 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-16 10:33 . 2009-05-20 21:24 4372512 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-16 10:33 . 2009-05-20 21:23 85280 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-16 10:33 . 2009-05-16 10:33 -------- d-----w c:\program files\Kaspersky Lab
2009-05-16 10:33 . 2009-05-20 21:13 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-15 15:01 . 2009-05-15 15:01 -------- d-----w C:\spoolerlogs
2009-05-15 14:11 . 2009-05-15 14:11 -------- d-----w c:\program files\PowerISO
2009-05-15 07:32 . 2009-05-15 07:32 -------- d-sh--w C:\found.000
2009-05-12 12:19 . 2009-05-12 12:19 -------- d-----w c:\program files\Common Files\Windows Live
2009-05-12 11:04 . 2009-05-12 11:08 -------- d-----w c:\program files\Might and Magic VI
2009-05-12 10:42 . 2008-04-13 21:17 25856 -c--a-w c:\windows\system32\dllcache\usbprint.sys
2009-05-12 10:42 . 2008-04-13 21:17 25856 ----a-w c:\windows\system32\drivers\usbprint.sys
2009-05-12 10:38 . 2009-05-12 10:38 -------- d-----w c:\program files\Hewlett-Packard
2009-05-11 14:19 . 2009-05-11 14:19 -------- d-----w c:\documents and settings\MAS\Application Data\CyberLink
2009-05-10 10:15 . 2009-05-10 10:15 -------- d--h--w c:\windows\PIF
2009-05-09 12:39 . 2009-05-17 20:50 -------- d-----w c:\program files\MessengerDiscovery
2009-05-09 12:33 . 2009-05-09 12:34 -------- d-----w c:\documents and settings\MAS\Application Data\Nuotex
2009-05-07 17:31 . 2009-05-07 17:31 56 ---ha-w c:\windows\system32\ezsidmv.dat
2009-05-07 17:31 . 2009-05-16 16:28 -------- d-----w c:\documents and settings\MAS\Application Data\skypePM
2009-05-07 17:30 . 2009-05-20 17:45 -------- d-----w c:\documents and settings\MAS\Application Data\Skype
2009-05-07 17:29 . 2009-05-07 17:29 -------- d-----w c:\program files\Common Files\Skype
2009-05-07 17:29 . 2009-05-07 17:29 -------- d-----r c:\program files\Skype
2009-05-07 17:29 . 2009-05-07 17:29 -------- d-----w c:\documents and settings\All Users\Application Data\Skype
2009-04-28 13:57 . 2009-04-28 13:59 -------- d-----w c:\program files\ExtractNow
2009-04-27 22:16 . 2009-05-11 19:45 -------- d-----w c:\documents and settings\MAS\Local Settings\Application Data\WMTools Downloaded Files
2009-04-21 20:29 . 2009-04-21 20:29 -------- d-----w c:\program files\danny_kay1710
2009-04-21 17:40 . 2009-04-21 17:44 -------- d-----w c:\program files\AVI ReComp
2009-04-21 17:28 . 2009-04-21 17:41 -------- d-----w c:\program files\AviSynth 2.5
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-20 21:21 . 2009-05-16 10:33 63692 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-20 21:21 . 2009-05-16 10:33 11060 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-16 11:01 . 2007-10-31 10:41 112144 ----a-w c:\windows\system32\drivers\kl1.sys
2009-05-09 12:03 . 2009-04-04 12:29 -------- d-----w c:\program files\Internet Download Manager
2009-04-21 17:28 . 2009-04-01 22:37 -------- d-----w c:\program files\Gabest
2009-04-17 18:31 . 2009-04-17 18:31 0 ----a-w c:\windows\nsreg.dat
2009-04-06 15:48 . 2009-03-29 18:27 463272 ----a-w c:\documents and settings\MAS\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-02 14:50 . 2009-04-02 14:46 -------- d-----w c:\program files\Common Files\3DO Shared
2009-04-02 14:46 . 2009-04-02 14:46 -------- d-----w c:\program files\3DO
2009-04-02 14:46 . 2009-04-02 14:46 -------- d-----w c:\program files\directx
2009-04-02 14:38 . 2009-04-02 14:37 -------- d-----w c:\program files\KONAMI
2009-04-01 22:53 . 2009-04-01 22:53 -------- d-----w c:\program files\DirectVobSub
2009-03-30 15:12 . 2009-03-30 15:12 -------- d-----w c:\program files\Circle Development
2009-03-30 15:12 . 2009-03-30 15:12 -------- d-----w c:\program files\Messenger Plus! Live
2009-03-30 15:11 . 2009-03-30 15:11 -------- d-----w c:\program files\uTorrent
2009-03-30 13:43 . 2009-03-30 13:43 -------- d-----w c:\program files\Quranzu1
2009-03-30 06:59 . 2009-03-29 18:56 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-30 06:59 . 2009-03-30 06:57 -------- d-----w c:\program files\QuickTime
2009-03-30 06:57 . 2009-03-29 19:06 -------- d-----w c:\program files\Common Files\InstallShield
2009-03-30 06:30 . 2009-03-29 18:46 -------- d-----w c:\program files\Common Files\Adobe
2009-03-29 19:12 . 2009-03-29 19:12 298104 ----a-w c:\windows\system32\imon.dll
2009-03-29 19:11 . 2009-03-29 19:11 -------- d-----w c:\program files\CONEXANT
2009-03-29 19:08 . 2009-03-29 19:06 -------- d-----w c:\program files\Realtek
2009-03-29 19:08 . 2009-03-29 19:03 16608 ----a-w c:\windows\gdrv.sys
2009-03-29 19:06 . 2009-03-29 19:06 315392 ----a-w c:\windows\HideWin.exe
2009-03-29 19:03 . 2009-03-29 19:03 -------- d-----w c:\program files\Intel
2009-03-29 19:00 . 2009-03-29 19:00 47104 ------w c:\windows\AKDeInstall.exe
2009-03-29 19:00 . 2009-03-29 19:00 -------- d-----w c:\program files\mpegable
2009-03-29 18:59 . 2009-03-29 18:59 -------- d-----w c:\program files\VideoLAN
2009-03-29 18:56 . 2009-03-29 18:56 -------- d-----w c:\program files\GRETECH
2009-03-29 18:56 . 2009-03-29 18:55 -------- d-----w c:\program files\CyberLink
2009-03-29 18:54 . 2009-03-29 18:44 505392 ----a-w c:\windows\system32\msvcp71.dll
2009-03-29 18:52 . 2009-03-29 18:52 -------- d-----w c:\program files\Common Files\xing shared
2009-03-29 18:52 . 2009-03-29 18:52 -------- d-----w c:\program files\Common Files\Real
2009-03-29 18:52 . 2009-03-29 18:44 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-03-29 18:52 . 2009-03-29 18:52 -------- d-----w c:\program files\Real
2009-03-29 18:51 . 2009-03-29 18:51 -------- d-----w c:\program files\Windows Media Connect 2
2009-03-29 18:49 . 2009-03-29 18:49 90112 ----a-w c:\windows\system32\agsaami.dll
2009-03-29 18:49 . 2009-03-29 18:49 610304 ----a-w c:\windows\system32\agsaamg.dll
2009-03-29 18:49 . 2009-03-29 18:49 372736 ----a-w c:\windows\system32\agsaamc.dll
2009-03-29 18:49 . 2009-03-29 18:49 2535424 ----a-w c:\windows\system32\agsaamj.dll
2009-03-29 18:49 . 2009-03-29 18:49 1986560 ----a-w c:\windows\system32\akll.dll
2009-03-29 18:49 . 2009-03-29 18:49 196608 ----a-w c:\windows\system32\maag.dll
2009-03-29 18:49 . 2009-03-29 18:49 1245184 ----a-w c:\windows\system32\bkll.dll
2009-03-29 18:49 . 2009-03-29 18:49 1212416 ----a-w c:\windows\system32\ckll.dll
2009-03-29 18:49 . 2009-03-29 18:49 -------- d-----w c:\program files\Real_SC
2009-03-29 18:48 . 2009-03-29 18:48 -------- d-----w c:\program files\Common Files\ACD Systems
2009-03-29 18:48 . 2009-03-29 18:48 -------- d-----w c:\program files\ACD Systems
2009-03-29 18:47 . 2009-03-29 18:47 10368 ----a-w c:\windows\system32\drivers\pfc.sys
2009-03-29 18:44 . 2009-03-29 18:44 -------- d-----w c:\program files\Common Files\Ahead
2009-03-29 18:44 . 2009-03-29 18:44 -------- d-----w c:\program files\Nero
2009-03-29 18:40 . 2009-03-29 18:39 -------- d-----w c:\program files\Golden Al-Wafi Translator
2009-03-29 18:39 . 2009-03-29 18:39 172032 ------w c:\windows\Setup1.exe
2009-03-29 18:39 . 2009-03-29 18:39 73216 ----a-w c:\windows\ST6UNST.EXE
2009-03-29 18:39 . 2009-03-29 18:39 -------- d-----w c:\program files\Windows Live
2009-03-29 18:39 . 2009-03-29 18:39 2232 ----a-w c:\windows\java\Packages\Data\V5RNDBPJ.DAT
2009-03-29 18:39 . 2009-03-29 18:39 155995 ----a-w c:\windows\java\Packages\IC9VHRLJ.ZIP
2009-03-29 18:39 . 2009-03-29 18:39 2678 ----a-w c:\windows\java\Packages\Data\
03R9Z7J5.DAT
2009-03-29 18:39 . 2009-03-29 18:39 2678 ----a-w c:\windows\java\Packages\Data\5FJLFHN3.DAT
2009-03-29 18:39 . 2009-03-29 18:39 2678 ----a-w c:\windows\java\Packages\Data\KOSH7JT3.DAT
2009-03-29 18:39 . 2009-03-29 18:39 2678 ----a-w c:\windows\java\Packages\Data\DZTRLNPB.DAT
2009-03-29 18:39 . 2009-03-29 18:39 2678 ----a-w c:\windows\java\Packages\Data\9B5BLVF1.DAT
2009-03-29 18:38 . 2009-03-29 18:38 1023035 ----a-w c:\windows\system32\Setup.scr
2009-03-29 18:29 . 2009-03-29 18:29 -------- d-----w c:\program files\Common Files\L&H
2009-03-29 18:29 . 2009-03-29 18:29 -------- d-----w c:\program files\Microsoft.NET
2009-03-29 18:29 . 2009-03-29 18:29 -------- d-----w c:\program files\Microsoft ActiveSync
2009-03-29 18:28 . 2009-03-29 18:28 -------- d-----w c:\program files\Microsoft Works
2009-03-29 18:21 . 2009-03-29 18:12 166455 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-03-29 18:13 . 2009-03-29 18:13 -------- d-----w c:\program files\microsoft frontpage
2009-03-29 18:13 . 2008-04-14 12:00 67 --sha-w c:\windows\Fonts\desktop.ini
2009-03-29 18:10 . 2009-03-29 18:10 21640 ----a-w c:\windows\system32\emptyregdb.dat
2009-03-15 10:25 . 2009-03-15 10:25 56268 ----a-w c:\windows\system32\drivers\scdemu.sys
2009-03-08 01:34 . 2008-04-14 12:00 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 01:34 . 2008-04-14 12:00 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 01:33 . 2008-04-14 12:00 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 01:33 . 2008-04-14 12:00 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 01:32 . 2008-04-14 12:00 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 01:32 . 2008-04-14 12:00 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 01:31 . 2008-04-14 12:00 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 01:31 . 2008-04-14 12:00 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 01:31 . 2008-04-14 12:00 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 01:22 . 2008-04-14 12:00 156160 ----a-w c:\windows\system32\msls31.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-04-21 24264488]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2008-10-28 2606512]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-05-14 1830128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"="=" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-05 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-05 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-05 137752]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-03-30 155648]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-29 185896]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2009-03-15 180224]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-02-13 16857600]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-3-30 113664]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 09:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^سرعة تشغيل Adobe Reader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\سرعة تشغيل Adobe Reader.lnk
backup=c:\windows\pss\سرعة تشغيل Adobe Reader.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [14/05/2009 02:22 م 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [14/05/2009 02:22 م 72944]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [13/12/2007 01:28 م 24592]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [14/05/2009 02:22 م 7408]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-msnmsgr - c:\program files\Windows Live\Messenger\msnmsgr.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: تحميل الكل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetVL.htm
LSP: c:\windows\system32\drivers\imon\imonlsp.dll
LSP: c:\windows\system32\imon.dll
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-21 00:23
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\
000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{41405ae9-1fe9-4cf3-ba33-917e81a30565}]
@Denied: (Full) (Everyone)
"Model"=dword:0000007e
"Therad"=dword:00000022
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):5c,89,18,26,77,cb,f3,e5,78,aa,c3,ec,70,bc,55,1e,6a,8a,b6,ec,b7,
22,00,12,7e,0a,e7,49,65,4b,06,30,23,ed,79,4c,01,53,9d,6c,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
@DACL=(02 0000)
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
@DACL=(02 0000)
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
@DACL=(02 0000)
"Installed"="1"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1264)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\windows\system32\klogon.dll
- - - - - - - > 'lsass.exe'(1320)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll
c:\windows\system32\imon.dll
- - - - - - - > 'explorer.exe'(2928)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\igfxsrvc.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
.
**************************************************************************
.
Completion time: 2009-05-20 0:26 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-20 21:26
Pre-Run: 50,454,851,584 bytes free
Post-Run: 51,927,535,616 bytes free
277
التقرير الاول
