تفضل واسف على التأخير
وهذا التقرير رقم واحد
ComboFix 09-06-26.02 - un 06/27/2009 2:16.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.2046.1601 [GMT 3:00]
Running from: c:\documents and settings\un\سطح المكتب\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\WinPCap
c:\program files\WinPCap\INSTALL.LOG
c:\program files\WinPCap\Uninstall.exe
c:\windows\system32\Bifrost
c:\windows\system32\Bifrost\klog.dat
c:\windows\system32\Packet.dll
c:\windows\system32\tmp.reg
c:\windows\system32\wpcap.dll
.
((((((((((((((((((((((((( Files Created from 2009-05-26 to 2009-06-26 )))))))))))))))))))))))))))))))
.
2009-06-26 10:48 . 2009-06-26 10:48 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{D5ABFFAD-D592-4F98-B02B-587125B4801F}
2009-06-26 08:46 . 2006-06-23 18:38 452096 ----a-w- c:\windows\system32\nmap.exe
2009-06-26 08:46 . 2006-06-23 18:38 192 ----a-w- c:\windows\system32\nmap_performance.reg
2009-06-26 08:46 . 2002-11-20 16:44 77824 ----a-w- c:\windows\system32\nmapwin.exe
2009-06-26 08:46 . 2002-11-20 15:06 290816 ----a-w- c:\windows\system32\nmapserv.exe
2009-06-26 08:46 . 2001-11-26 21:13 114688 ----a-w- c:\windows\system32\CCGNU32.dll
2009-06-26 08:46 . 2003-03-18 23:03 544768 ----a-w- c:\windows\system32\msvcr71d.dll
2009-06-26 08:46 . 1999-04-16 21:06 10752 ----a-w- c:\windows\system32\aamd532.dll
2009-06-26 08:46 . 2004-03-01 17:55 561179 ----a-w- c:\windows\system32\dao360.dll
2009-06-26 08:46 . 1998-06-17 21:00 299008 ----a-w- c:\windows\system32\MSDBRPTR.DLL
2009-06-26 08:46 . 1998-06-08 21:00 137216 ----a-w- c:\windows\system32\MSDERUN.DLL
2009-06-26 08:46 . 1999-03-26 00:00 101888 ----a-w- c:\windows\system32\VB6STKIT.DLL
2009-06-26 08:46 . 2009-06-26 08:46 -------- d-----w- c:\program files\Net Tools
2009-06-26 07:33 . 2009-06-26 07:33 -------- d-----w- c:\windows\system32\wbem\Repository
2009-06-26 07:16 . 2009-06-26 07:33 -------- d-----w- c:\program files\XP TCPIP Repair
2009-06-26 06:30 . 2009-06-26 06:30 -------- d-----w- c:\documents and settings\LocalService\Application Data\Intel
2009-06-26 05:44 . 2009-06-26 05:44 -------- d-----w- C:\EVTERM1
2009-06-26 05:41 . 2009-06-26 05:41 -------- d-----w- c:\windows\system32\backups
2009-06-26 05:41 . 2009-06-26 05:41 139930 ----a-w- c:\windows\system32\Pass2.cmd
2009-06-26 05:27 . 2009-06-26 05:27 -------- d-----w- C:\RegSupreme
2009-06-26 05:25 . 2009-06-26 05:26 -------- d-----w- C:\Zyzoom_KavScan
2009-06-26 05:22 . 2009-06-26 05:22 -------- d-----w- c:\documents and settings\un\Local Settings\Application Data\G DATA
2009-06-26 05:22 . 2009-06-26 05:22 -------- d-----w- C:\!KillBox
2009-06-24 21:56 . 2009-06-24 21:56 -------- d-----w- c:\documents and settings\un\Application Data\Desktopicon
2009-06-24 21:56 . 2009-06-24 21:56 -------- d-----w- c:\program files\FormatFactory
2009-06-24 21:56 . 2009-06-24 21:56 -------- d-----w- c:\program files\Power Mp3 Cutter(Mp3 Sound Cutter)
2009-06-24 21:25 . 2003-03-18 20:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2009-06-24 21:25 . 2009-06-24 21:25 -------- d-----w- c:\program files\Alwil Software
2009-06-15 15:40 . 2009-06-15 15:40 -------- d-----w- c:\program files\Common Files\xing shared
2009-06-13 23:13 . 2009-06-13 23:13 -------- d-----w- c:\documents and settings\un\Local Settings\Application Data\Opera
2009-06-13 23:13 . 2009-06-18 14:36 -------- d-----w- c:\program files\Opera
2009-06-13 21:06 . 2009-06-13 21:06 -------- d-----w- C:\Downloads
2009-06-13 21:05 . 2009-06-13 21:34 -------- d-----w- c:\program files\FlashGet
2009-06-13 16:13 . 2009-06-26 07:04 -------- d-----w- c:\documents and settings\un\Application Data\Metacafe
2009-06-13 16:13 . 2009-06-26 22:48 -------- d-----w- c:\program files\Common Files\Akamai
2009-06-13 16:12 . 2009-06-16 23:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Metacafe
2009-06-13 16:12 . 2009-06-13 16:12 -------- d-----w- c:\program files\Metacafe
2009-06-11 23:03 . 2009-06-11 23:04 -------- d-----w- c:\program files\Propel Accelerator
2009-06-11 23:03 . 2009-06-11 23:04 2765952 ----a-w- C:\PROPELSETUP.EXE
2009-06-11 22:53 . 2009-06-11 22:54 27319 ----a-w- c:\documents and settings\un\Application Data\IDM\DwnlData\un\japsetup_151\japsetup.exe
2009-06-09 14:07 . 2009-06-09 14:07 -------- d-----w- c:\program files\LtUcx
2009-05-29 01:21 . 2009-06-25 18:18 117760 ----a-w- c:\documents and settings\un\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-05-29 01:20 . 2009-05-29 01:20 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-05-29 01:20 . 2009-06-25 18:22 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-05-29 01:20 . 2009-05-29 01:20 -------- d-----w- c:\documents and settings\un\Application Data\SUPERAntiSpyware.com
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-26 23:20 . 2009-05-09 00:37 -------- d-----w- c:\documents and settings\un\Application Data\DMCache
2009-06-26 22:53 . 2001-09-19 12:00 59878 ----a-w- c:\windows\system32\perfc001.dat
2009-06-26 22:53 . 2001-09-19 12:00 331342 ----a-w- c:\windows\system32\perfh001.dat
2009-06-26 11:12 . 2009-05-12 18:45 -------- d-----w- c:\program files\Kaspersky Lab
2009-06-26 00:00 . 2009-05-06 22:12 -------- d-----w- c:\documents and settings\un\Application Data\Skype
2009-06-25 21:03 . 2009-05-06 22:21 -------- d-----w- c:\documents and settings\un\Application Data\skypePM
2009-06-25 18:22 . 2009-05-22 07:41 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-06-22 12:22 . 2009-05-09 21:34 -------- d-----w- c:\documents and settings\un\Application Data\uTorrent
2009-06-15 15:39 . 2009-05-06 19:40 -------- d-----w- c:\program files\Common Files\Real
2009-06-15 15:39 . 2009-05-08 02:57 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-06-15 15:39 . 2009-05-08 02:57 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-06-12 10:52 . 2009-05-22 07:42 -------- d-----w- c:\program files\TuneUp Utilities 2008
2009-05-28 17:10 . 2009-05-12 18:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-05-26 12:08 . 2009-05-26 12:07 -------- d-----w- c:\program files\LeapFTP
2009-05-25 19:13 . 2009-05-25 19:13 0 ----a-w- c:\documents and settings\un\Application Data\IDM\DwnlData\un\lftp275_78\lftp275.exe
2009-05-22 07:42 . 2009-05-22 07:42 355584 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-05-22 07:42 . 2009-05-22 07:42 -------- d-----w- c:\documents and settings\un\Application Data\TuneUp Software
2009-05-22 07:42 . 2009-05-22 07:42 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-05-17 07:49 . 2009-05-06 18:50 99416 ----a-w- c:\documents and settings\un\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-17 07:38 . 2009-05-17 07:38 -------- d-----w- c:\program files\Microsoft.NET
2009-05-17 07:16 . 2009-05-17 06:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-05-16 03:23 . 2009-05-16 03:23 45056 ----a-r- c:\documents and settings\un\Application Data\Microsoft\Installer\{885A63EA-382B-4DD4-A755-14809B8557D6}\ARPPRODUCTICON.exe
2009-05-16 03:19 . 2009-05-06 18:12 -------- d-----w- c:\program files\Common Files\InstallShield
2009-05-14 10:06 . 2009-05-14 10:06 -------- d-----w- c:\program files\Justdo Software
2009-05-14 10:06 . 2009-05-14 10:06 -------- d-----w- c:\program files\Common Files\Justdo
2009-05-14 10:06 . 2009-05-06 18:12 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-11 15:41 . 2009-05-06 19:27 -------- d-----w- c:\program files\Windows Live
2009-05-11 15:17 . 2009-05-11 15:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-05-10 17:36 . 2009-05-09 00:37 -------- d-----w- c:\documents and settings\un\Application Data\IDM
2009-05-09 21:34 . 2009-05-06 19:45 -------- d-----w- c:\program files\uTorrent
2009-05-09 13:13 . 2009-05-09 00:37 -------- d-----w- c:\program files\Internet Download Manager
2009-05-09 01:01 . 2009-05-09 01:01 -------- d-----w- c:\documents and settings\un\Application Data\Thinstall
2009-05-09 00:37 . 2009-05-09 00:37 198064 ----a-w- c:\documents and settings\un\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-05-08 23:25 . 2009-05-08 23:25 -------- d-----w- c:\program files\MSXML 6.0
2009-05-08 21:14 . 2009-05-08 21:13 -------- d-----w- c:\program files\PHP Expert Editor 4.2
2009-05-08 20:38 . 2009-05-06 22:56 -------- d-----w- c:\documents and settings\un\Application Data\Paltalk
2009-05-08 20:38 . 2009-05-06 22:56 -------- d-----w- c:\program files\Paltalk Messenger
2009-05-08 02:58 . 2009-05-08 02:58 278528 ----a-w- c:\windows\system32\livesnth.dll
2009-05-08 02:58 . 2009-05-08 02:58 203776 ----a-w- c:\windows\system32\clrviddc.dll
2009-05-08 02:55 . 2009-05-08 02:55 390664 ----a-w- c:\documents and settings\un\Application Data\Real\RealPlayer\setup\AU_setup6.exe
2009-05-07 23:56 . 2009-05-07 23:53 -------- dcsh--w- c:\program files\Common Files\WindowsLiveInstaller
2009-05-07 23:53 . 2009-05-07 23:53 -------- d-----w- c:\documents and settings\All Users\Application Data\WLInstaller
2009-05-07 23:49 . 2009-05-07 23:49 -------- d-----w- c:\program files\Common Files\Windows Live
2009-05-07 21:58 . 2009-05-07 21:58 -------- d-----w- c:\program files\Google
2009-05-07 15:42 . 2004-08-03 21:55 344064 ----a-w- c:\windows\system32\localspl.dll
2009-05-07 11:34 . 2009-05-06 19:29 -------- d-----w- c:\program files\Messenger Plus! Live
2009-05-07 11:32 . 2009-05-07 11:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-06 23:08 . 2009-05-06 19:29 -------- d-----w- c:\program files\Circle Developement
2009-05-06 22:45 . 2009-05-06 22:45 -------- d-----w- c:\documents and settings\un\Application Data\ESET
2009-05-06 22:44 . 2009-05-06 22:44 -------- d-----w- c:\program files\ESET
2009-05-06 22:44 . 2009-05-06 22:44 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-05-06 22:21 . 2009-05-06 22:21 32 ----a-w- c:\documents and settings\All Users\Application Data\ezsid.dat
2009-05-06 22:14 . 2009-05-06 22:14 0 ----a-w- c:\windows\nsreg.dat
2009-05-06 20:18 . 2009-05-06 20:18 -------- d-----w- c:\documents and settings\un\Application Data\ACD Systems
2009-05-06 20:15 . 2009-05-06 20:14 -------- d-----w- c:\program files\The KMPlayer
2009-05-06 20:08 . 2009-05-06 20:08 -------- d-----w- c:\program files\Common Files\ACD Systems
2009-05-06 20:08 . 2009-05-06 20:08 -------- d-----w- c:\documents and settings\All Users\Application Data\ACD Systems
2009-05-06 20:08 . 2009-05-06 20:08 -------- d-----w- c:\program files\ACD Systems
2009-05-06 19:52 . 2009-05-06 19:51 -------- d-----w- c:\program files\LeapFTP 3.0
2009-05-06 19:40 . 2009-05-06 19:40 -------- d-----w- c:\program files\Real
2009-05-06 19:32 . 2009-05-06 19:23 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-06 19:29 . 2009-05-06 19:28 -------- d-----w- c:\program files\Hotspot Shield
2009-05-06 19:26 . 2009-05-06 19:26 -------- d-----w- c:\program files\Skype
2009-05-06 19:26 . 2009-05-06 19:26 -------- d-----w- c:\program files\Common Files\Skype
2009-05-06 19:26 . 2009-05-06 19:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-05-06 19:18 . 2009-05-06 19:08 -------- d-----w- c:\documents and settings\un\Application Data\Sony Corporation
2009-05-06 19:18 . 2009-05-06 19:06 -------- d-----w- c:\program files\Sony
2009-05-06 19:14 . 2009-05-06 19:14 -------- d-----w- c:\program files\Protector Suite QL
2009-05-06 19:14 . 2009-05-06 19:14 -------- d-----w- c:\documents and settings\All Users\Application Data\UIB
2009-05-06 19:12 . 2009-05-06 19:06 -------- d-----w- c:\program files\Common Files\Sony Shared
2009-05-06 19:02 . 2009-05-06 19:02 21393 ----a-w- c:\windows\system32\drivers\AegisP.sys
2009-05-06 19:02 . 2009-05-06 19:02 21393 ----a-w- c:\windows\AegisP.sys
2009-05-06 19:02 . 2009-05-06 19:02 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Intel
2009-05-06 19:01 . 2009-05-06 19:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Intel
2009-05-06 19:01 . 2009-05-06 18:38 -------- d-----w- c:\program files\Intel
2009-05-06 19:00 . 2009-05-06 19:00 -------- d-----w- c:\program files\SonyImgF
2009-05-06 18:56 . 2009-05-06 18:56 -------- d-----w- c:\program files\Synaptics
2009-05-06 18:56 . 2009-05-06 18:56 -------- d-----w- c:\program files\MSIcon
2009-05-06 18:55 . 2009-05-06 18:55 -------- d-----w- c:\program files\CONEXANT
2009-05-06 18:49 . 2009-05-06 18:49 -------- d-----w- c:\documents and settings\un\Application Data\ATI
2009-05-06 18:47 . 2009-05-06 18:41 -------- d-----w- c:\program files\ATI Technologies
2009-05-06 18:45 . 2009-05-06 18:45 10134 ----a-r- c:\documents and settings\un\Application Data\Microsoft\Installer\{B7E26579-230C-D0EB-4E4A-AF97783163F7}\ARPPRODUCTICON.exe
2009-05-06 18:44 . 2009-05-06 18:44 9158 ----a-r- c:\documents and settings\un\Application Data\Microsoft\Installer\{F1FD0F66-34CF-4555-8B13-BCFC96F3864C}\NewShortcut1_45160C5661F6468DA5B09FAE2C3E68D6.exe
2009-05-06 18:44 . 2009-05-06 18:44 10134 ----a-r- c:\documents and settings\un\Application Data\Microsoft\Installer\{F1FD0F66-34CF-4555-8B13-BCFC96F3864C}\ARPPRODUCTICON.exe
2009-05-06 18:44 . 2009-05-06 18:44 10134 ----a-r- c:\documents and settings\un\Application Data\Microsoft\Installer\{65603810-E19A-863C-D1BF-49FBE96FD57C}\ARPPRODUCTICON.exe
2009-05-06 18:34 . 2009-05-06 18:34 -------- d-----w- c:\program files\WIDCOMM
2009-05-06 18:12 . 2009-05-06 18:12 -------- d-----w- c:\program files\Realtek
2009-05-06 18:12 . 2009-05-06 18:12 315392 ----a-w- c:\windows\HideWin.exe
2009-05-06 17:28 . 2009-05-06 17:03 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-06 17:04 . 2009-05-06 17:04 -------- d-----w- c:\program files\microsoft frontpage
2009-05-06 17:01 . 2009-05-06 17:01 22144 ----a-w- c:\windows\system32\emptyregdb.dat
2009-04-29 04:43 . 2004-08-03 21:55 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:42 . 2004-08-03 21:55 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-19 20:08 . 2004-08-03 21:46 1846528 ----a-w- c:\windows\system32\win32k.sys
2009-04-18 06:37 . 2009-04-18 06:37 2929528 ----a-w- c:\documents and settings\un\Application Data\Thinstall\Trojan Remover 6.7.8\%AppData%\Simply Super Software\Trojan Remover\cmu85bf.exe
2009-04-15 15:12 . 2004-08-03 21:55 584192 ----a-w- c:\windows\system32\rpcrt4.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2007-01-05 10:41 2857984 ----a-w- c:\program files\Protector Suite QL\farchns.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2007-01-05 10:41 2857984 ----a-w- c:\program files\Protector Suite QL\farchns.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-10 68856]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-05-09 2807216]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VAIOCameraUtility"="c:\program files\Sony\VAIO Camera Utility\VCUServe.exe" [2007-02-07 411768]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-15 198160]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-02-20 774233]
"Switcher.exe"="c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe" [2007-08-31 503808]
"SonyPowerCfg"="c:\program files\Sony\VAIO Power Management\SPMgr.exe" [2007-03-26 217088]
"PSQLLauncher"="c:\program files\Protector Suite QL\launcher.exe" [2007-01-05 49168]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2008-02-20 53248]
"MsgCenterExe"="c:\program files\Common Files\Real\Update_OB\RealOneMessageCenter.exe" [2009-06-15 69632]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\un\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-5-6 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2007-01-05 10:28 90112 ----a-w- c:\windows\system32\psqlpwd.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2007-05-16 17:50 73728 ----a-w- c:\windows\system32\VESWinlogon.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
Notification Packages REG_MULTI_SZ psqlpwd scecli
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*
isabled
xpsp2res.dll,-22009
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [04/08/2004 12:56 ص 14336]
R3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\system32\drivers\R5U870FLx86.sys [06/05/2009 09:37 م 73472]
R3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\system32\drivers\R5U870FUx86.sys [06/05/2009 09:37 م 43904]
R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\drivers\SonyImgF.sys [06/05/2009 10:00 م 30976]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [06/05/2009 09:53 م 808448]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
2009-06-26 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 06:09]
2009-06-26 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
2009-06-26 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Save Flash with Flash Catcher - c:\program files\Common Files\Justdo\IECatcher.DLL/FlashCatcher.htm
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: ت&صدير إلى Microsoft Excel
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
IE: {{90BAE0EF-F4BF-4FAC-B2EC-2C725C34AF12} - res://c:\program files\Common Files\Justdo\IECatcher.DLL/FlashCatcher.htm
DPF: {B7FDB0C3-4724-46D2-B8DB-6FA1DC63F7CA} - hxxp://98.126.42.42/ReadUid.CAB
FF - ProfilePath - c:\documents and settings\un\Application Data\Mozilla\Firefox\Profiles\912tivp8.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - component: c:\documents and settings\un\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-06-27 02:20
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1128)
c:\windows\system32\vrlogon.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\psqlpwd.dll
c:\program files\Protector Suite QL\homefus2.dll
c:\program files\Protector Suite QL\infra.dll
c:\program files\Protector Suite QL\homepass.dll
c:\program files\Protector Suite QL\bio.dll
c:\program files\Protector Suite QL\remote.dll
c:\windows\system32\VESWinlogon.dll
c:\program files\Protector Suite QL\crypto.dll
- - - - - - - > 'lsass.exe'(1184)
c:\windows\system32\psqlpwd.dll
c:\program files\Protector Suite QL\homefus2.dll
c:\program files\Protector Suite QL\infra.dll
.
Completion time: 2009-06-26 2:21
ComboFix-quarantined-files.txt 2009-06-26 23:21
Pre-Run: 122,457,853,952 bytes free
Post-Run: 122,434,891,776 bytes free
282
