اوقى تم التنفيذ
النتيجة
ComboFix 09-05-30.04 - ali 05/31/2009 15:59.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1033.18.502.232 [GMT 0:00]
Running from: d:\movies\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\LocalService\Application Data\twain_32
c:\documents and settings\LocalService\Application Data\twain_32\user.ds
c:\documents and settings\NetworkService\Application Data\twain_32
c:\documents and settings\NetworkService\Application Data\twain_32\user.ds
c:\program files\VirusHeat 3.9
c:\program files\VirusHeat 3.9\ignored.lst
c:\program files\VirusHeat 3.9\sdebug.log
c:\program files\VirusHeat 3.9\vht.dat
c:\program files\VirusHeat 3.9\vpp.ini
c:\windows\b151.exe.bin
c:\windows\cdmxtras
c:\windows\cdmxtras\uninst.exe
c:\windows\config.ini
c:\windows\Downloaded Program Files\WebP2PInstaller.dll
c:\windows\fbdzj.exe
c:\windows\ftebh.exe
c:\windows\IE4 Error Log.txt
c:\windows\smdat32m.sys
c:\windows\sysounrk.exe
c:\windows\system32\twain_32
c:\windows\system32\twain_32\local.ds
c:\windows\system32\twain_32\user.ds
c:\windows\system32\twain_32\user.ds.cla
c:\windows\system32\u2g.f
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NPF
-------\Service_NPF
((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-31 )))))))))))))))))))))))))))))))
.
2009-05-31 14:48 . 2009-05-31 14:48 -------- d-----w- c:\program files\Trend Micro
2009-05-24 15:14 . 2009-05-31 12:44 -------- d-----w- c:\program files\Panda Security
2009-05-22 12:06 . 2009-05-25 17:19 -------- d-----w- c:\documents and settings\visitor.USER.001
2009-05-22 09:04 . 2009-05-22 09:05 -------- d-----w- c:\documents and settings\visitor.USER.000
2009-05-21 11:32 . 2009-05-21 11:32 -------- d-----w- c:\documents and settings\visitor.USER
2009-05-21 11:24 . 2009-05-21 11:25 -------- d-----w- c:\documents and settings\visitor
2009-05-21 11:09 . 2009-05-21 11:09 -------- d-----w- c:\windows\system32\wbem\Repository
2009-05-21 00:17 . 2009-05-21 00:17 -------- d-----w- c:\documents and settings\ali\.jpi_cache
2009-05-21 00:17 . 2009-05-21 00:17 -------- d-----w- c:\documents and settings\ali\.java
2009-05-20 08:58 . 2009-05-20 08:58 -------- d-----w- c:\documents and settings\guest1
2009-05-18 22:20 . 2009-05-24 14:48 -------- d-----w- c:\documents and settings\LASD_PERMISSIONS
2009-05-18 22:20 . 2009-05-18 22:20 -------- d-----w- c:\documents and settings\LASD_PERMISSIONS\.jpi_cache
2009-05-18 22:20 . 2009-05-18 22:20 -------- d-----w- c:\documents and settings\LASD_PERMISSIONS\.java
2009-05-06 04:44 . 2008-10-16 21:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-05-06 04:44 . 2008-10-16 21:06 208744 ----a-w- c:\windows\system32\muweb.dll
2009-05-05 07:04 . 2009-05-21 10:56 -------- d-----w- c:\documents and settings\ali\Tracing
2009-05-05 07:03 . 2009-05-05 07:03 -------- d-----w- c:\program files\Microsoft
2009-05-05 07:03 . 2009-05-05 07:03 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-05-05 07:02 . 2009-05-05 07:03 -------- d-----w- c:\program files\Windows Live
2009-05-05 06:57 . 2009-05-05 06:57 -------- d-----w- c:\program files\Common Files\Windows Live
2009-05-02 05:42 . 2009-05-02 05:42 664 ----a-w- c:\windows\system32\d3d9caps.dat
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-31 16:06 . 2006-09-08 05:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-31 16:03 . 2008-06-30 09:22 794656 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-05-31 16:03 . 2008-06-30 09:22 4844 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-05-31 16:03 . 2008-06-30 09:22 3164704 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-05-31 16:03 . 2008-06-30 09:22 26852 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-05-31 15:48 . 2009-01-08 08:34 -------- d-----w- c:\documents and settings\ali\Application Data\cleaner
2009-05-28 18:06 . 2006-09-08 04:36 -------- d-----w- c:\program files\Golden Al-Wafi Translator
2009-05-24 21:33 . 2006-09-08 03:23 182960 ----a-w- c:\documents and settings\ali\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-21 11:32 . 2006-09-08 05:10 -------- d-----w- c:\program files\Real
2009-05-20 22:23 . 2008-06-30 09:23 105395 ----a-w- c:\windows\system32\drivers\klin.dat
2009-05-20 22:23 . 2008-06-30 09:23 94643 ----a-w- c:\windows\system32\drivers\klick.dat
2009-05-15 21:05 . 2009-05-15 21:05 74240 ----a-w- c:\program files\l
2009-05-11 23:26 . 2008-12-29 02:26 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-05-11 13:16 . 2006-09-08 05:07 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-09 06:37 . 2009-03-02 07:26 -------- d-----w- c:\program files\Learning Essentials
2009-05-05 06:56 . 2006-09-08 04:38 -------- d-----w- c:\program files\MSN Messenger
2009-05-05 05:54 . 2008-07-31 07:33 -------- d-----w- c:\program files\Advanced PC Tweaker
2009-05-05 05:19 . 2008-01-23 05:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-04-23 07:05 . 2009-04-23 07:05 -------- d-----w- c:\program files\Apple Software Update
2009-04-19 08:18 . 2009-04-19 08:18 -------- d-----w- c:\program files\File Pulverizer
2009-04-17 10:34 . 2008-02-02 02:03 -------- d-----w- c:\documents and settings\ali\Application Data\Skype
2009-04-17 01:29 . 2008-02-02 02:02 -------- d-----r- c:\program files\Skype
2009-04-17 01:29 . 2008-02-02 02:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-04-16 20:59 . 2009-04-16 20:59 -------- d-----w- c:\documents and settings\ali\Application Data\Nokia Multimedia Player
2009-04-11 04:59 . 2007-08-15 17:33 -------- d-----w- c:\program files\DIFX
2009-04-11 04:57 . 2009-04-11 04:57 -------- d-----w- c:\program files\Common Files\Nokia
2009-04-11 04:57 . 2009-01-01 11:15 -------- d-----w- c:\program files\Common Files\PCSuite
2009-04-11 04:57 . 2009-01-01 11:13 -------- d-----w- c:\program files\Nokia
2009-04-05 04:02 . 2009-03-27 04:51 -------- d-----w- c:\documents and settings\ali\Application Data\Hide IP NG
2009-04-02 08:01 . 2009-04-02 08:01 -------- d-----w- c:\program files\Common Files\xing shared
2009-04-02 08:01 . 2006-09-08 05:10 -------- d-----w- c:\program files\Common Files\Real
2009-04-02 08:00 . 2005-09-09 00:20 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-03-31 06:17 . 2009-03-31 06:17 390664 ----a-w- c:\documents and settings\ali\Application Data\Real\RealPlayer\Update\RealPlayer11.exe
2009-03-06 14:22 . 2004-08-03 22:56 284160 ----a-w- c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-08-03 22:56 826368 ----a-w- c:\windows\system32\wininet.dll
2008-06-05 05:12 . 2008-06-05 05:12 220 --sh--w- c:\windows\dwin.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-04-12 1409024]
"L07AXLRD_11202437"="c:\program files\Microsoft Student\Microsoft Student with Encarta Premium 2007 DVD\EDICT.EXE" [2008-11-10 351000]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-07 3885408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-06 201992]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-02 198160]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoSecCPL"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoConfigPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoNetSetup"= 0 (0x0)
"NoNetSetupIDPage"= 0 (0x0)
"NoNetSetupSecurityPage"= 0 (0x0)
"NoWorkgroupContents"= 0 (0x0)
"NoEntireNetwork"= 0 (0x0)
"NoFileSharingControl"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"RestrictRun"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)
"NoThumbnailCache"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{D468BCE5-D18E-49A4-8EA7-34BD583659D5}"= "c:\progra~1\SpyZooka\spyguard.dll" [2005-05-08 173568]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
path=
backup=
[HKLM\~\startupfolder\C:^Documents and Settings^ali^Start Menu^Programs^Startup^AntiCrash.lnk]
backup=c:\windows\pss\AntiCrash.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^palstart.exe]
backup=c:\windows\pss\palstart.exeCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PalStart.lnk]
backup=c:\windows\pss\PalStart.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PalTalk.lnk]
backup=c:\windows\pss\PalTalk.lnkCommon Startup
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\PalTalk.lnk
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\2177F056-0AA6-4D6C-A944-13F71F341C29
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AltnetPointsManager
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVP
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BullGuard
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Device Detector
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dll
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriveDiscoveryMemoryResident
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Download Manager
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Upload Manager
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Uploader Oe Integration
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kav
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAV50
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Propel Accelerator
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\english\\setup.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57288:TCP"= 57288:TCP
ando P2P TCP Listening Port
"57288:UDP"= 57288:UDP
ando P2P UDP Listening Port
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [30/01/2008 01:29 ص 33808]
R2 Uniblue DiskRescue;Uniblue DiskRescue;c:\program files\Uniblue\DiskRescue\UBDiskRescueSrv.exe [10/09/2008 03:22 م 229648]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [14/03/2008 02:02 ص 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [26/03/2008 04:07 ص 24592]
S1 oxser;GPRS PC TRIBAND CARD driver;c:\windows\system32\drivers\oxser.sys [19/07/2007 04:30 م 51182]
S3 i740;i740;c:\windows\system32\drivers\i740nt5.sys [08/09/2006 03:37 ص 58592]
S3 kvpndev;Kerio VPN adapter;c:\windows\system32\drivers\kvpndrv.sys [09/02/2008 12:58 م 66048]
.
Contents of the 'Scheduled Tasks' folder
2009-05-22 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2006\SystemOptimizer.exe [2005-09-22 05:35]
2009-05-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]
2009-04-16 c:\windows\Tasks\One-Click Tweak.job
- c:\program files\Advanced PC Tweaker\OneClick.exe [2008-07-31 00:55]
2008-10-20 c:\windows\Tasks\Uniblue DiskRescue 2009.job
- c:\program files\Uniblue\DiskRescue\UBDiskRescue.exe [2008-09-10 15:22]
.
- - - - ORPHANS REMOVED - - - -
SafeBoot-procexp90.Sys
MSConfigStartUp-rose - (no file)
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyServer = socks=127.0.0.1:7070
uInternet Settings,ProxyOverride = plimus.com;
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
FF - ProfilePath - c:\documents and settings\ali\Application Data\Mozilla\Firefox\Profiles\e46wo9p7.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\Java\j2re1.4.1_02\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.1_02\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.1_02\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.1_02\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.1_02\bin\NPJPI141_02.dll
FF - plugin: c:\program files\Java\j2re1.4.1_02\bin\NPOJI610.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-31 16:07
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\sccfg.sys 134 bytes
scan completed successfully
hidden files: 1
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1214440339-884357618-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_USERS\S-1-5-21-1214440339-884357618-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0ECC4738-588C-5B02-8980-444E491DA5E1}*]
"jambfbjelhhjafdggaei"=hex:62,61,6d,6c,00,00
"iamcjlhjogbacicnmm"=hex:6b,61,70,6c,6d,61,6a,69,67,6d,61,65,6b,68,6d,6e,6d,69,
6e,6c,6f,6f,00,00
"jambfbjelhhjafdggaii"=hex:62,61,61,6c,00,00
"hacdlcdckjghodcd"=hex:6b,61,70,6c,6d,61,6a,69,67,6d,61,65,6b,68,70,6f,6b,69,
62,6f,6f,6e,00,00
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{04abc0be-9428-4ea3-8720-0e03d60ebee4}]
@Denied: (Full) (Everyone)
"Model"=dword:00000088
"Therad"=dword:0000001e
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,1a,0d,14,5a,44,5b,8f,4c,c4,9f,27,cf,25,5d,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):84,e4,d7,d5,73,51,f8,c2,3d,81,8f,db,fa,c8,32,b4,9c,a2,d0,96,ed,
25,60,79,ed,d9,7c,d7,15,8b,f6,d9,11,17,17,fe,b6,b0,88,9f,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):59,4e,cb,64,cf,c6,cb,ca,71,5d,35,0f,65,c3,c7,1a,d8,f4,50,f3,47,
ec,58,42,90,d5,10,a6,d0,e4,05,eb,0f,7f,80,fb,34,ea,57,47,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{caea633b-e0f5-4eb8-9e93-80132f92d5c6}]
@Denied: (Full) (Everyone)
"Model"=dword:00000154
"Therad"=dword:0000000f
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,a8,a0,29,c3,8a,9a,90,75,31,ca,cf,aa,7f,d2,a8,af,d1,7a,29,5a,a8,57,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1576)
c:\windows\system32\klogon.dll
- - - - - - - > 'explorer.exe'(3464)
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
c:\program files\PC Connectivity Solution\ConnAPI.DLL
c:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_ara.nlr
c:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\HPZipm12.exe
c:\progra~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
c:\progra~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclIrSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
.
**************************************************************************
.
Completion time: 2009-05-31 16:10 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-31 16:10
Pre-Run: 6,312,931,328 bytes free
Post-Run: 6,217,695,232 bytes free
310 --- E O F --- 2009-05-29 21:29
