تفضل اخووي .......
ComboFix 09-07-09.08 - xZAIDx 07/11/2009 20:49.1.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1256.962.1033.18.1015.457 [GMT 4:00]
Running from: c:\documents and settings\xZAIDx\Desktop\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\kakle.dll
.
((((((((((((((((((((((((( Files Created from 2009-06-11 to 2009-07-11 )))))))))))))))))))))))))))))))
.
2009-07-11 06:06 . 2009-07-11 06:06 -------- d-sh--w- C:\FOUND.004
2009-07-10 16:49 . 2009-07-10 16:49 -------- d-----w- C:\3gp video
2009-07-10 16:48 . 2009-07-10 16:48 -------- d-----w- c:\program files\Easy Video to 3GP Converter
2009-07-10 16:46 . 2009-07-10 16:46 -------- d-----w- c:\docume~1\xZAIDx\APPLIC~1\GetRightToGo
2009-07-10 15:07 . 2009-07-10 15:07 -------- d-----w- c:\docume~1\xZAIDx\APPLIC~1\CyberScrub
2009-07-10 15:05 . 2009-07-10 15:05 -------- d-----w- c:\docume~1\xZAIDx\APPLIC~1\cleaner
2009-07-10 13:43 . 2009-07-10 13:43 -------- d-----w- c:\program files\Apex
2009-07-09 22:36 . 2009-07-09 22:36 -------- d-----w- c:\program files\Trend Micro
2009-07-09 20:49 . 2009-07-09 20:49 -------- d-----w- c:\program files\QuickTime
2009-07-09 20:48 . 2007-02-20 12:04 190696 ----a-w- c:\windows\system32\NPSWF32_FlashUtil.exe
2009-07-09 20:48 . 2007-02-20 12:04 2463976 ----a-w- c:\windows\system32\NPSWF32.dll
2009-07-09 20:47 . 2009-07-09 20:47 -------- d-----w- c:\program files\Bonjour
2009-07-09 20:33 . 2009-07-09 20:33 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-07-09 20:31 . 2009-07-09 20:31 -------- d-----w- c:\program files\Common Files\Adobe
2009-07-09 19:58 . 2009-07-09 19:58 -------- d-----w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-09 19:57 . 2009-07-09 19:57 -------- d-----w- c:\documents and settings\All Users\Application Data\SpeedBit
2009-07-09 19:57 . 2009-07-09 19:57 -------- d-----w- c:\program files\DAP
2009-07-07 17:01 . 2009-07-07 17:01 -------- d-----w- c:\program files\MSECache
2009-07-07 15:14 . 2006-10-26 15:56 32592 ----a-w- c:\windows\system32\msonpmon.dll
2009-07-07 15:12 . 2009-07-07 15:12 -------- d-----w- c:\program files\Microsoft Works
2009-07-07 15:10 . 2009-07-07 15:10 -------- d-----w- c:\program files\Microsoft.NET
2009-07-07 15:07 . 2009-07-07 15:07 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-07-07 15:06 . 2009-07-07 15:06 -------- d-----w- c:\windows\SHELLNEW
2009-07-07 15:06 . 2009-07-07 15:06 -------- d-----w- c:\documents and settings\xZAIDx\Local Settings\Application Data\Microsoft Help
2009-07-07 15:06 . 2009-07-07 15:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-07-06 20:15 . 2009-07-06 20:15 -------- d-sh--w- C:\FOUND.003
2009-07-06 17:01 . 2006-08-29 14:56 32377 ----a-w- c:\windows\system32\drivers\prodigy.sys
2009-07-06 17:01 . 2009-07-06 17:01 -------- d-----w- c:\program files\NSS
2009-07-06 15:02 . 2009-07-06 15:02 0 ----a-w- c:\windows\nsreg.dat
2009-07-06 15:02 . 2009-07-06 15:02 -------- d-----w- c:\documents and settings\xZAIDx\Local Settings\Application Data\Mozilla
2009-07-06 13:07 . 2009-07-06 13:07 -------- d-sh--w- C:\FOUND.002
2009-07-03 22:40 . 2009-07-03 22:40 -------- d-----w- c:\program files\MobiMB Mobile Media Browser
2009-06-30 18:00 . 2009-06-30 18:00 -------- d-----w- c:\program files\Common Files\PCSuite
2009-06-30 18:00 . 2009-06-30 18:00 -------- d-----w- c:\program files\Common Files\Nokia
2009-06-30 17:57 . 2008-08-26 06:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2009-06-30 17:57 . 2009-06-30 17:57 -------- d-----w- c:\program files\PC Connectivity Solution
2009-06-30 17:56 . 2009-02-09 04:37 7808 ----a-w- c:\windows\system32\drivers\usbser_lowerfltj.sys
2009-06-30 17:56 . 2009-02-09 04:37 7808 ----a-w- c:\windows\system32\drivers\usbser_lowerflt.sys
2009-06-30 17:56 . 2009-02-09 04:37 22016 ----a-w- c:\windows\system32\drivers\ccdcmbo.sys
2009-06-30 17:56 . 2009-02-09 04:37 659968 ----a-w- c:\windows\system32\nmwcdcocls.dll
2009-06-30 17:56 . 2009-02-09 04:37 17664 ----a-w- c:\windows\system32\drivers\ccdcmb.sys
2009-06-30 17:56 . 2009-02-09 04:32 1112288 ----a-w- c:\windows\system32\wdfcoinstaller01007.dll
2009-06-30 17:55 . 2009-06-30 17:54 33775224 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{55495E65-7C5B-48E4-BC7D-DE54F3DE5ED6}\Nokia_PC_Suite_7_1_30_8_eng.exe
2009-06-30 17:54 . 2009-06-30 17:54 95232 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{55495E65-7C5B-48E4-BC7D-DE54F3DE5ED6}\Installer\CommonCustomActions\pcswpcsi.exe
2009-06-30 17:54 . 2009-06-30 17:54 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{55495E65-7C5B-48E4-BC7D-DE54F3DE5ED6}\Installer\CommonCustomActions\UninstCCD.exe
2009-06-30 17:54 . 2009-06-30 17:54 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{55495E65-7C5B-48E4-BC7D-DE54F3DE5ED6}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-06-30 17:54 . 2009-06-30 17:54 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{55495E65-7C5B-48E4-BC7D-DE54F3DE5ED6}\Installer\CommonCustomActions\UninstPCS.exe
2009-06-29 22:03 . 2008-04-13 19:45 26112 ----a-w- c:\windows\system32\drivers\usbser.sys
2009-06-29 22:03 . 2008-04-13 19:45 26112 ----a-w- c:\windows\system32\dllcache\usbser.sys
2009-06-29 22:03 . 2008-03-21 09:57 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll
2009-06-28 20:52 . 2009-06-28 20:52 -------- d--h--w- c:\windows\PIF
2009-06-28 07:04 . 2009-06-28 07:04 -------- d-----w- c:\docume~1\xZAIDx\APPLIC~1\Nokia
2009-06-28 07:03 . 2009-06-28 07:04 -------- d-----w- c:\docume~1\xZAIDx\APPLIC~1\PC Suite
2009-06-28 07:03 . 2009-06-28 07:04 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite
2009-06-28 07:02 . 2009-06-28 07:02 -------- d-----w- c:\program files\DIFX
2009-06-28 07:02 . 2009-02-09 04:37 91136 ----a-w- c:\windows\system32\nmwcdcls.dll
2009-06-28 07:02 . 2009-06-28 07:02 -------- d-----w- c:\program files\Nokia
2009-06-28 07:02 . 2009-06-27 19:10 34348464 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{AC4E9457-107B-448F-AD89-605E122E8C59}\Nokia_PC_Suite_7_1_26_1_eng_web.exe
2009-06-28 07:01 . 2009-06-28 07:01 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{AC4E9457-107B-448F-AD89-605E122E8C59}\Installer\CommonCustomActions\UninstCCD.exe
2009-06-28 07:01 . 2009-06-28 07:01 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{AC4E9457-107B-448F-AD89-605E122E8C59}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-06-28 07:01 . 2009-06-28 07:01 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{AC4E9457-107B-448F-AD89-605E122E8C59}\Installer\CommonCustomActions\UninstPCS.exe
2009-06-28 07:01 . 2009-06-28 07:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations
2009-06-27 20:56 . 2009-06-27 20:56 -------- d-----w- c:\docume~1\xZAIDx\APPLIC~1\Reflexive Arcade
2009-06-27 20:48 . 2009-06-27 20:48 -------- d-----w- c:\program files\ReflexiveArcade
2009-06-26 19:37 . 2009-06-26 19:37 -------- d-----w- c:\windows\system32\XPSViewer
2009-06-26 19:37 . 2009-06-26 19:37 -------- d-----w- c:\program files\MSBuild
2009-06-26 19:37 . 2009-06-26 19:37 -------- d-----w- c:\program files\Reference Assemblies
2009-06-26 19:37 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-06-26 19:37 . 2008-07-06 12:06 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-06-26 19:37 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-06-26 19:37 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-06-26 19:37 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-06-26 19:37 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-06-26 19:37 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll
2009-06-26 10:19 . 2009-06-26 10:19 -------- d-----w- c:\documents and settings\All Users\Application Data\TechSmith
2009-06-26 10:19 . 2009-06-26 10:19 -------- d-----w- c:\program files\TechSmith
2009-06-26 10:19 . 2009-06-26 10:19 -------- d-----w- c:\documents and settings\xZAIDx\Local Settings\Application Data\TechSmith
2009-06-26 10:19 . 2009-06-26 10:19 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-06-26 08:26 . 2009-06-26 08:26 -------- d-----w- c:\windows\system32\scripting
2009-06-26 08:26 . 2009-06-26 08:26 -------- d-----w- c:\windows\l2schemas
2009-06-26 08:26 . 2009-06-26 08:26 -------- d-----w- c:\windows\system32\en
2009-06-26 08:26 . 2009-06-26 08:26 -------- d-----w- c:\windows\system32\bits
2009-06-26 08:23 . 2009-06-26 08:23 -------- d-----w- c:\windows\ServicePackFiles
2009-06-26 07:34 . 2009-06-26 07:34 -------- d-----w- c:\documents and settings\xZAIDx\Local Settings\Application Data\Identities
2009-06-24 19:30 . 2009-06-24 19:30 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Swift Sound
2009-06-24 19:19 . 2009-06-24 19:19 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-06-24 19:14 . 2009-06-24 19:14 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-06-24 19:14 . 2009-06-19 23:22 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft
2009-06-24 19:14 . 2009-06-24 19:14 -------- d-----w- c:\documents and settings\Administrator
2009-06-24 19:13 . 2009-06-24 19:13 -------- d-sh--w- C:\FOUND.001
2009-06-24 18:32 . 2009-06-24 18:32 -------- d-----w- c:\docume~1\xZAIDx\APPLIC~1\Softplicity
2009-06-24 18:30 . 2009-06-24 18:30 -------- d-----w- c:\docume~1\xZAIDx\APPLIC~1\AVS4YOU
2009-06-24 18:30 . 2009-06-24 18:30 -------- d-----w- c:\documents and settings\xZAIDx\Local Settings\Application Data\Google
2009-06-24 18:30 . 2009-06-24 18:30 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2009-06-24 18:29 . 2009-06-24 18:29 -------- d-----w- c:\program files\Common Files\AVSMedia
2009-06-24 18:29 . 2009-06-24 18:29 -------- d-----w- c:\program files\AVS4YOU
2009-06-24 18:29 . 2007-02-27 14:36 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2009-06-24 18:29 . 2007-02-27 14:36 24576 ----a-w- c:\windows\system32\msxml3a.dll
2009-06-24 18:26 . 2009-06-24 18:26 -------- d-----w- c:\docume~1\xZAIDx\APPLIC~1\FairStars Audio Converter
2009-06-24 18:24 . 2009-06-24 18:25 196608 ----a-w- c:\windows\system32\maag.dll
2009-06-24 18:24 . 2009-06-24 18:25 1212416 ----a-w- c:\windows\system32\ckll.dll
2009-06-24 18:24 . 2009-06-24 18:25 90112 ----a-w- c:\windows\system32\agsaami.dll
2009-06-24 18:24 . 2009-06-24 18:25 610304 ----a-w- c:\windows\system32\agsaamg.dll
2009-06-24 18:24 . 2009-06-24 18:25 372736 ----a-w- c:\windows\system32\agsaamc.dll
2009-06-24 18:24 . 2009-06-24 18:25 2535424 ----a-w- c:\windows\system32\agsaamj.dll
2009-06-24 18:24 . 2009-06-24 18:25 1986560 ----a-w- c:\windows\system32\akll.dll
2009-06-24 18:24 . 2009-06-24 18:25 1245184 ----a-w- c:\windows\system32\bkll.dll
2009-06-24 18:24 . 2009-06-24 18:25 53760 ----a-w- c:\windows\system\ppacklib.dll
2009-06-24 18:24 . 2009-06-24 18:24 -------- d-----w- c:\windows\system32\RMBin
2009-06-24 18:24 . 2009-06-24 18:24 -------- d-----w- c:\program files\Real_SC
2009-06-24 17:50 . 2009-06-24 17:50 -------- d-----w- c:\docume~1\xZAIDx\APPLIC~1\Media Player Classic
2009-06-24 17:49 . 2009-06-24 17:49 -------- d-----w- c:\program files\Google
2009-06-24 17:49 . 2009-06-24 17:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-06-24 17:48 . 2009-06-24 17:48 -------- d-----w- c:\program files\Common Files\Real
2009-06-24 17:48 . 2009-06-24 17:48 -------- d-----w- c:\program files\Ringz Studio
2009-06-23 17:59 . 2009-06-23 17:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Ukodukai Systems
2009-06-23 17:59 . 2009-06-23 17:59 0 ----a-w- c:\documents and settings\All Users\Application Data\Ukodukai Systems\Embeded Devices\{0ea50d53-ce1a-4baf-9abc-85a3b2451ef4}\AppControl.dll
2009-06-23 17:55 . 2009-06-23 17:55 -------- d-----w- c:\documents and settings\All Users\Application Data\RachaelSoft
2009-06-23 17:55 . 2009-06-23 17:55 -------- d-----w- c:\documents and settings\All Users\Application Data\{A047F26D-4602-4aaf-ACE7-F6F2ECEC34F9}
2009-06-23 17:55 . 2009-06-23 17:55 -------- d-----w- c:\docume~1\xZAIDx\APPLIC~1\Twilight Games
2009-06-23 08:22 . 2009-06-23 08:22 -------- d-sh--w- C:\FOUND.000
2009-06-22 21:53 . 2009-06-22 21:53 -------- d-----w- c:\windows\ie8updates
2009-06-22 17:35 . 2008-06-13 12:05 272128 ------w- c:\windows\system32\dllcache\bthport.sys
2009-06-22 17:35 . 2008-06-13 12:05 272128 ------w- c:\windows\system32\drivers\bthport.sys
2009-06-22 17:34 . 2009-04-30 22:22 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-11 12:22 . 2009-06-20 13:50 16160 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-07-11 12:22 . 2009-06-20 13:50 126548 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-07-03 23:25 . 2009-07-03 23:25 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2009-07-03 23:25 . 2009-07-03 23:25 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
2009-06-29 22:03 . 2009-06-29 22:03 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-06-29 22:03 . 2009-06-29 22:03 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-06-26 08:31 . 2009-06-19 23:22 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-20 14:48 . 2007-04-28 12:51 112144 ----a-w- c:\windows\system32\drivers\kl1.sys
2009-06-19 23:30 . 2009-06-19 23:30 -------- d-----w- c:\program files\Realtek
2009-06-19 23:30 . 2009-06-19 23:30 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-19 23:30 . 2009-06-19 23:30 315392 ----a-w- c:\windows\HideWin.exe
2009-06-19 23:30 . 2009-06-19 23:30 -------- d-----w- c:\program files\Common Files\InstallShield
2009-06-19 23:23 . 2009-06-19 23:23 -------- d-----w- c:\program files\microsoft frontpage
2009-06-19 23:20 . 2009-06-19 23:20 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-05-13 06:15 . 2004-08-03 21:07 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-11 08:47 . 2009-05-11 08:47 1302600 ----a-w- c:\windows\system32\WUDFUpdate_01007.dll
2009-05-07 16:32 . 2004-08-03 21:07 345600 ----a-w- c:\windows\system32\localspl.dll
2009-04-17 13:26 . 2004-08-03 21:07 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 15:51 . 2004-08-03 21:07 585216 ----a-w- c:\windows\system32\rpcrt4.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-26 4351216]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-25 39408]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-12 1414144]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-01-12 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-01-12 163840]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-01-12 135168]
"StormCodec_Helper"="c:\program files\Ringz Studio\Storm Codec\StormSet.exe" [2006-11-26 97357]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-11-21 16858112]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
SnagIt 9.lnk - c:\program files\TechSmith\SnagIt 9\SnagIt32.exe [2008-5-15 6822728]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\groove.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [04/04/2007 02:58 م 24344]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-07-11 c:\windows\Tasks\User_Feed_Synchronization-{FADCA56E-E0F1-4B56-A38D-9D6E21876D56}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 00:31]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-DownloadAccelerator - c:\program files\DAP\DAP.EXE
.
------- Supplementary Scan -------
.
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*
IE: &Clean Traces - c:\program files\DAP\Privacy Package\dapcleanerie.htm
IE: &Download with &DAP - c:\program files\DAP\dapextie.htm
IE: Download &all with DAP - c:\program files\DAP\dapextie2.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\docume~1\xZAIDx\APPLIC~1\Mozilla\Firefox\Profiles\6xuu2x0n.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.jo/
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "
");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-07-11 20:55
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1064)
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll
c:\windows\system32\klogon.dll
- - - - - - - > 'lsass.exe'(1120)
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll
.
Completion time: 2009-07-11 20:58
ComboFix-quarantined-files.txt 2009-07-11 16:58
Pre-Run: 20,267,745,280 bytes free
Post-Run: 20,422,164,480 bytes free
295 --- E O F --- 2009-07-07 23:01
ان شاء الله خير :i::i::i:
