اللهيعين عيونك على الخربطه اللي راح تشوفها
هذا هو
ComboFix 09-05-22.04 - dont tray 05/23/2009 0:04.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.1014.539 [GMT 3:00]
Running from: c:\documents and settings\dont tray\سطح المكتب\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\windows\system32\kakle.dll
G:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2009-04-22 to 2009-05-22 )))))))))))))))))))))))))))))))
.
2009-05-22 12:27 . 2009-05-22 12:27 -------- d-----w c:\program files\Acoustica MP3 Audio Mixer
2009-05-19 11:24 . 2009-05-19 11:24 -------- d-----w c:\documents and settings\dont tray\Application Data\Uniblue
2009-05-19 11:22 . 2009-05-19 14:48 -------- d-----w c:\documents and settings\All Users\Application Data\WinZip
2009-05-19 11:22 . 2009-05-19 19:20 -------- d-----w c:\program files\خرابيط
2009-05-13 13:12 . 2009-05-13 13:12 57344 ----a-w c:\documents and settings\dont tray\Application Data\Sun\Java\Deployment\cache\6.0\50\5b902232-342d7c47-n\Decora-SSE.dll
2009-05-13 13:11 . 2009-05-13 13:11 24064 ----a-w c:\documents and settings\dont tray\Application Data\Sun\Java\Deployment\cache\6.0\15\4e09eacf-34c0ee85-n\Decora-D3D.dll
2009-05-13 13:11 . 2009-05-13 13:11 114688 ----a-w c:\documents and settings\dont tray\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-3858c2b8-n\jogl_cg.dll
2009-05-13 13:11 . 2009-05-13 13:11 315392 ----a-w c:\documents and settings\dont tray\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-3858c2b8-n\jogl.dll
2009-05-13 13:11 . 2009-05-13 13:11 20480 ----a-w c:\documents and settings\dont tray\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-3858c2b8-n\jogl_awt.dll
2009-05-13 13:11 . 2009-05-13 13:11 20480 ----a-w c:\documents and settings\dont tray\Application Data\Sun\Java\Deployment\cache\6.0\45\4f710eed-4dc8132f-n\gluegen-rt.dll
2009-05-13 13:11 . 2009-05-13 13:11 499712 ----a-w c:\documents and settings\dont tray\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-1b3f4279-n\msvcp71.dll
2009-05-13 13:11 . 2009-05-13 13:11 348160 ----a-w c:\documents and settings\dont tray\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-1b3f4279-n\msvcr71.dll
2009-05-13 13:11 . 2009-05-13 13:11 499712 ----a-w c:\documents and settings\dont tray\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-1b3f4279-n\jmc.dll
2009-05-13 10:58 . 2009-05-13 10:58 152576 ----a-w c:\documents and settings\dont tray\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-06 20:48 . 2009-05-06 20:48 -------- d-----w c:\documents and settings\dont tray\Application Data\Ahead
2009-05-06 20:47 . 2005-12-23 14:50 32768 ----a-w c:\windows\system32\BCGPOleAcc.dll
2009-05-06 20:47 . 2005-10-17 14:07 2600960 ----a-w c:\windows\system32\BCGCBPRO800.dll
2009-05-06 20:47 . 2004-07-26 14:16 476320 ----a-w c:\windows\system32\imagXpr7.dll
2009-05-06 20:47 . 2004-07-26 14:16 471040 ----a-w c:\windows\system32\imagXRA7.dll
2009-05-06 20:47 . 2004-07-26 14:16 262144 ----a-w c:\windows\system32\imagXR7.dll
2009-05-06 20:47 . 2004-07-09 06:43 364544 ----a-w c:\windows\system32\TwnLib4.dll
2009-05-06 20:47 . 2009-05-06 20:47 -------- d-----w c:\program files\Nero
2009-05-06 20:47 . 2005-10-17 14:15 2605056 ----a-w c:\windows\system32\BCGCBPRO800u.dll
2009-05-06 20:47 . 2004-07-26 14:16 1568768 ----a-w c:\windows\system32\imagX7.dll
2009-05-06 20:47 . 2003-03-18 18:12 1047552 ----a-w c:\windows\system32\mfc71u.dll
2009-05-05 17:18 . 2009-05-05 17:18 -------- d-----w c:\program files\Rapidshare Unlimited
2009-05-01 17:26 . 2009-05-22 21:10 -------- d-----w c:\documents and settings\dont tray\Application Data\Free Download Manager
2009-05-01 17:26 . 2009-05-01 17:26 -------- d-----w c:\program files\Free Download Manager
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-22 21:10 . 2009-02-27 20:38 663584 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-22 21:10 . 2009-02-27 20:38 6492 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-22 21:10 . 2009-02-27 20:38 4895776 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-22 21:10 . 2009-02-27 20:38 42472 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-22 21:10 . 2009-02-27 21:17 -------- d-----w c:\documents and settings\dont tray\Application Data\uTorrent
2009-05-22 21:06 . 2003-01-27 17:31 40316 ----a-w c:\windows\system32\perfc001.dat
2009-05-22 21:06 . 2003-01-27 17:31 251946 ----a-w c:\windows\system32\perfh001.dat
2009-05-22 21:01 . 2009-02-27 20:38 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-22 16:08 . 2009-02-27 20:17 164024 ----a-w c:\documents and settings\dont tray\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-22 12:25 . 2009-03-27 12:04 -------- d-----w c:\documents and settings\dont tray\Application Data\Skype
2009-05-20 12:40 . 2009-02-27 20:39 94643 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-20 12:40 . 2009-02-27 20:39 105395 ----a-w c:\windows\system32\drivers\klin.dat
2009-05-13 13:07 . 2009-02-28 00:18 -------- d-----w c:\program files\Java
2009-05-06 20:47 . 2009-02-27 23:07 -------- d-----w c:\program files\Common Files\Ahead
2009-05-03 20:40 . 2009-02-27 21:41 -------- d-----w c:\program files\Golden Al-Wafi Translator
2009-05-03 20:40 . 2009-02-27 21:41 172032 ------w c:\windows\Setup1.exe
2009-05-03 20:40 . 2009-02-27 21:41 73216 ----a-w c:\windows\ST6UNST.EXE
2009-04-16 22:31 . 2009-04-16 22:31 -------- d-----w c:\program files\Microsoft.NET
2009-04-15 19:58 . 2009-02-27 23:25 -------- d-----w c:\program files\Common Files\Adobe
2009-04-15 19:25 . 2009-04-15 19:25 -------- d-----w c:\program files\K-Lite Codec Pack
2009-04-15 15:19 . 2009-02-27 20:21 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-15 15:19 . 2009-04-15 15:19 -------- d-----w c:\program files\PowerQuest
2009-04-15 08:44 . 2009-04-05 09:40 -------- d-----w c:\program files\BitComet
2009-04-13 15:22 . 2009-04-13 15:22 -------- d-----w c:\documents and settings\All Users\Application Data\FreeDownloadManager.ORG
2009-04-13 13:38 . 2009-04-13 13:38 -------- d-----w c:\program files\FDRLab
2009-04-02 20:41 . 2009-04-02 20:41 3638 ----a-r c:\documents and settings\dont tray\Application Data\Microsoft\Installer\{B6BCCB80-B3FC-4E97-8513-A7BEE73A5C5A}\_DA901F6E06F4058DAAFC89.exe
2009-04-02 20:41 . 2009-04-02 20:41 3638 ----a-r c:\documents and settings\dont tray\Application Data\Microsoft\Installer\{B6BCCB80-B3FC-4E97-8513-A7BEE73A5C5A}\_7A9FA4B2D5D7A1776D8621.exe
2009-04-02 20:41 . 2009-04-02 20:41 10134 ----a-r c:\documents and settings\dont tray\Application Data\Microsoft\Installer\{B6BCCB80-B3FC-4E97-8513-A7BEE73A5C5A}\_F40D4AAD4F1A1A2FCFE4F5.exe
2009-04-02 20:41 . 2009-04-02 20:41 10134 ----a-r c:\documents and settings\dont tray\Application Data\Microsoft\Installer\{B6BCCB80-B3FC-4E97-8513-A7BEE73A5C5A}\_B47BC57F69D156A56BB9FC.exe
2009-04-02 20:41 . 2009-04-02 20:41 10134 ----a-r c:\documents and settings\dont tray\Application Data\Microsoft\Installer\{B6BCCB80-B3FC-4E97-8513-A7BEE73A5C5A}\_5B7D40271E61ED50356E9C.exe
2009-04-02 20:41 . 2009-04-02 20:41 -------- d-----w c:\program files\Teorex
2009-03-28 20:56 . 2009-03-28 20:56 -------- d-----w c:\program files\Zone Labs
2009-03-27 16:16 . 2009-03-27 16:16 -------- d-----w c:\program files\Common Files\xing shared
2009-03-27 16:16 . 2009-02-27 21:46 -------- d-----w c:\program files\Common Files\Real
2009-03-27 15:43 . 2009-03-27 12:04 -------- d-----r c:\program files\Skype
2009-03-27 15:43 . 2009-03-27 12:04 -------- d-----w c:\documents and settings\All Users\Application Data\Skype
2009-03-26 17:27 . 2009-03-26 17:27 -------- d-----w c:\documents and settings\dont tray\Application Data\Talkback
2009-03-26 17:26 . 2009-03-26 17:26 0 ----a-w c:\windows\nsreg.dat
2009-03-24 18:28 . 2009-02-27 23:16 -------- d-----w c:\program files\Circle Developement
2009-03-22 11:54 . 2009-03-22 11:54 390664 ----a-w c:\documents and settings\dont tray\Application Data\Real\RealPlayer\Update\RealPlayer11.exe
2009-03-09 02:19 . 2009-02-28 01:16 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-02 20:18 . 2009-02-27 19:35 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-02-28 01:15 . 2009-02-28 01:15 152576 ----a-w c:\documents and settings\dont tray\Application Data\Sun\Java\jre1.6.0_11\lzma.dll
2009-02-27 22:44 . 2008-01-29 15:29 33808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-02-27 22:44 . 2009-02-27 21:11 33808 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\klbg.sys
2009-02-27 22:44 . 2009-02-27 21:11 213520 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\XP\klif.sys
2009-02-27 22:44 . 2009-02-27 21:10 861448 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\updater.dll
2009-02-27 22:42 . 2009-02-27 22:42 90112 ----a-w c:\windows\system32\agsaami.dll
2009-02-27 22:42 . 2009-02-27 22:42 610304 ----a-w c:\windows\system32\agsaamg.dll
2009-02-27 22:42 . 2009-02-27 22:42 372736 ----a-w c:\windows\system32\agsaamc.dll
2009-02-27 22:42 . 2009-02-27 22:42 2535424 ----a-w c:\windows\system32\agsaamj.dll
2009-02-27 22:42 . 2009-02-27 22:42 1986560 ----a-w c:\windows\system32\akll.dll
2009-02-27 22:42 . 2009-02-27 22:42 196608 ----a-w c:\windows\system32\maag.dll
2009-02-27 22:42 . 2009-02-27 22:42 1245184 ----a-w c:\windows\system32\bkll.dll
2009-02-27 22:42 . 2009-02-27 22:42 1212416 ----a-w c:\windows\system32\ckll.dll
2009-02-27 21:11 . 2009-02-27 21:11 21256 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\vkbd.dll
2009-02-27 21:10 . 2009-02-27 21:10 83208 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\mzvkbd.dll
2009-02-27 21:10 . 2009-02-27 21:10 62728 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\ievkbd.dll
2009-02-27 21:10 . 2009-02-27 21:10 43784 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\fssync.dll
2009-02-27 21:10 . 2009-02-27 21:09 365832 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\ckahum.dll
2009-02-27 21:09 . 2009-02-27 21:09 201992 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\avp.exe
2009-02-27 19:32 . 2009-02-27 19:32 22144 ----a-w c:\windows\system32\emptyregdb.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-06 39408]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-02-27 270128]
"Google Update"="c:\documents and settings\dont tray\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-03-31 133104]
"Free Download Manager"="c:\program files\Free Download Manager\fdm.exe" [2009-01-30 3399727]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-08-03 1032192]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-13 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-13 118784]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-27 185872]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-27 201992]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-03-24 282624]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-03 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-4-15 113664]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-5-24 622653]
SnagIt 8.lnk - c:\program files\TechSmith\SnagIt 8\SnagIt32.exe [2007-5-1 6395464]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2009-5-19 122880]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9920:TCP"= 9920:TCP:lpmabqcm
"19252:TCP"= 19252:TCP:BitComet 19252 TCP
"19252:UDP"= 19252:UDP:BitComet 19252 UDP
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 06:29 م 33808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 07:02 م 26640]
S2 afdxs;Windows Manager;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 12:56 ص 14336]
S2 dkktrpul;Server Shell;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 12:56 ص 14336]
S2 etatn;Config Installer;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 12:56 ص 14336]
S2 gatisdobp;System Universal;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 12:56 ص 14336]
S2 gxhbr;Server Universal;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 12:56 ص 14336]
S2 jokcfh;Universal Microsoft;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 12:56 ص 14336]
S2 tgindli;Installer Center;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 12:56 ص 14336]
S2 uggiaeey;tzotzq;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 12:56 ص 14336]
S2 uwpte;Center Universal;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 12:56 ص 14336]
S2 wbglz;Microsoft Helper;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 12:56 ص 14336]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [25/03/2008 08:07 م 24592]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
uwpte
wbglz
tgindli
gxhbr
gatisdobp
etatn
uggiaeey
dkktrpul
afdxs
jokcfh
.
Contents of the 'Scheduled Tasks' folder
2009-05-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1177238915-1500820517-839522115-1003.job
- c:\documents and settings\dont tray\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-31 18:14]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-BitComet - c:\program files\BitComet\BitComet.exe
HKCU-Run-Software Informer - c:\program files\Software Informer\softinfo.exe
HKCU-Run-Uniblue RegistryBooster 2 - c:\program files\Uniblue\RegistryBooster 2\RegistryBooster.exe
SafeBoot-procexp90.Sys
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/webhp?sourceid=navclient&ie=UTF-8
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: تحميل الفيديو بواسطة Free Download Manager -
files\Free Download Manager\dlfvideo.htm
IE: تحميل الكل بواسطة Free Download Manager -
files\Free Download Manager\dlall.htm
IE: تحميل المحددة بواسطة Free Download Manager -
files\Free Download Manager\dlselected.htm
IE: تحميل بواسطة Free Download Manager -
files\Free Download Manager\dllink.htm
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-23 00:12
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dkktrpul]
"ServiceDll"="c:\windows\system32\pcnjgctl.dll"
--
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\etatn]
"ServiceDll"="c:\windows\system32\pcnjgctl.dll"
--
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gatisdobp]
"ServiceDll"="c:\windows\system32\pcnjgctl.dll"
--
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gxhbr]
"ServiceDll"="c:\windows\system32\pcnjgctl.dll"
--
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\jokcfh]
"ServiceDll"="c:\windows\system32\pcnjgctl.dll"
--
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tgindli]
"ServiceDll"="c:\windows\system32\pcnjgctl.dll"
--
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\uggiaeey]
"ServiceDll"="c:\windows\system32\pcnjgctl.dll"
--
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\uwpte]
"ServiceDll"="c:\windows\system32\pcnjgctl.dll"
--
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\wbglz]
"ServiceDll"="c:\program files\Internet Explorer\pcnjgctl.dll"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(972)
c:\windows\system32\klogon.dll
c:\windows\System32\BCMLogon.dll
- - - - - - - > 'explorer.exe'(3588)
c:\windows\system32\msi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Dell\QuickSet\NicConfigSvc.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\TechSmith\SnagIt 8\TscHelp.exe
c:\program files\WIDCOMM\Bluetooth Software\BTStackServer.exe
c:\program files\TechSmith\SnagIt 8\SnagPriv.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
c:\program files\Internet Explorer\iexplore.exe
.
**************************************************************************
.
Completion time: 2009-05-22 0:15 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-22 21:15
Pre-Run: 20,260,397,056 bytes free
Post-Run: 31,894,675,456 bytes free
270
