هلا بك
اعمل التالي
حمل هذه الأداة
عند تشغيل الاداة نضغط كما محدد بالصورة التالية
ونوافق على الرسائل التي تخرج وفي حال خروج تحذير من برنامج الحماية نعمل له سماح
وبعدها اعد تشغيل الجهاز
وبعد اعادة التشغيل طبق التالي
عطل برامج الحماية عن العمل
ثم
حمل الاداة التالية واحفظها على سطح المكتب
عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
اثناء الفحص ممكن يعاد تشغيل الجهاز
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
لا تقم بتشغيل اي برنامج ،، ومهما طالت عملية الفحص انتظر حتى تنتهي
انتظر حتى يظهر لك تقرير ،،انسخه والصقه بمشاركتك القادمة
وعطني هذا التقرير مع تقرير جديد الي طلبته منك في بدايه الموضوع
التقرير كما طلبت
وانا اشكرك جداا
ComboFix 09-08-02.04 - user321 08/03/2009 19:01.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.964.1033.18.1014.678 [GMT 4:00]
Running from: c:\documents and settings\user321\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\lssexp.dll
c:\windows\system32\mfc45.dll
c:\windows\system32\mhnrl.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NPF
((((((((((((((((((((((((( Files Created from 2009-07-03 to 2009-08-03 )))))))))))))))))))))))))))))))
.
2009-08-03 13:41 . 2009-08-03 13:41 -------- d-----w- c:\program files\Trend Micro
2009-08-02 09:30 . 2009-08-02 09:30 -------- d-----w- c:\documents and settings\LocalService\SiteAdvisor
2009-08-02 05:54 . 2009-08-02 05:54 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\SodaBush Windowpaper XP v1.01\1000000600002i\svchost.exe
2009-08-02 05:54 . 2009-08-02 05:54 -------- d-----w- c:\windows\Installer
2009-08-02 05:54 . 2009-08-02 05:54 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\SodaBush Windowpaper XP v1.01\10000001600002i\msiexec.exe
2009-08-01 21:34 . 2009-08-01 21:34 -------- d-----w- c:\documents and settings\user321\Application Data\SodaBush
2009-08-01 21:22 . 2009-08-01 21:22 -------- d-----w- c:\program files\VMware
2009-08-01 11:56 . 2009-08-01 11:56 -------- d-----w- c:\documents and settings\user321\Application Data\Malwarebytes
2009-08-01 11:56 . 2008-10-16 16:25 15504 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-01 11:56 . 2008-10-16 16:25 38496 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-01 11:56 . 2009-08-01 11:56 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-01 11:56 . 2009-08-01 11:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-01 10:00 . 2009-08-01 10:00 -------- d-----w- c:\program files\IE Accelerator
2009-08-01 09:16 . 2009-08-01 09:16 -------- d-----w- c:\program files\Common Files\McAfee
2009-08-01 09:16 . 2009-08-01 09:16 -------- d-----w- c:\program files\McAfee
2009-08-01 09:00 . 2009-08-01 09:00 -------- d-----w- c:\program files\Yahoo!
2009-08-01 07:49 . 2009-08-01 07:49 15212353 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\Driver Genius Professional Edition\%Temp%\DrvSetup.exe
2009-08-01 07:16 . 2009-08-01 07:16 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\WinASO Registry Optimizer 3.0.6\40000015c00002i\WinASORD.exe
2009-07-31 17:50 . 2009-07-31 17:50 -------- d-----w- c:\documents and settings\user321\Application Data\MOVAVI
2009-07-31 15:25 . 2009-07-31 15:25 -------- d-----w- c:\documents and settings\user321\Local Settings\Application Data\Panda Software
2009-07-30 06:51 . 2009-07-30 06:51 -------- d-----w- c:\documents and settings\user321\Application Data\Reallusion
2009-07-30 06:50 . 2009-07-30 06:50 -------- d-----w- c:\program files\Common Files\Reallusion
2009-07-29 22:21 . 2009-07-29 22:21 -------- d-----w- c:\documents and settings\user321\Application Data\HTML Executable
2009-07-29 09:17 . 2009-07-29 09:17 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\Recover My Photos\4000003e00002i\igfxsrvc.exe
2009-07-29 08:06 . 2009-07-29 08:06 -------- d-----w- c:\program files\ibraheem_tech
2009-07-29 07:29 . 2009-07-29 07:29 11264 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\MP3Gain\40000040800003i\mp3gain.exe
2009-07-29 04:53 . 2009-07-29 04:53 294912 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\ThinstallBuilder\4000007d00003i\tlink.exe
2009-07-29 04:53 . 2009-07-29 04:53 294912 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\ThinstallBuilder\4000005100003i\vftool.exe
2009-07-29 04:53 . 2009-07-29 04:53 294912 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\ThinstallBuilder\4000005800003i\vregtool.exe
2009-07-27 22:31 . 2009-07-27 22:31 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\NOD32 antivirus system\400000f200002i\nod32kui.exe
2009-07-27 22:31 . 2009-07-27 22:31 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\NOD32 antivirus system\4000008900002i\nod32krn.exe
2009-07-26 16:56 . 2009-07-26 16:56 95928 ----a-w- c:\documents and settings\user321\Application Data\IDM\idmmzcc\components\idmmzcc.dll
2009-07-26 16:55 . 2009-07-26 16:55 53248 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\Microsoft Office Enterprise 2007\30000000d900002h\DW20.EXE
2009-07-26 16:55 . 2009-07-26 16:55 53248 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\Microsoft Office Enterprise 2007\30000000a0300002h\MSACCESS.EXE
2009-07-26 09:07 . 2009-07-26 09:07 -------- d-----w- c:\documents and settings\user321\Application Data\Gold Wave Editor
2009-07-25 20:36 . 2009-07-25 20:36 35363 ----a-w- c:\windows\system32\windrvNT.sys
2009-07-25 20:36 . 2009-07-25 20:36 53248 ----a-w- c:\windows\system32\suppdll.dll
2009-07-25 04:24 . 2009-07-29 08:19 -------- d-----w- c:\documents and settings\user321\Application Data\DMCache
2009-07-25 04:24 . 2009-07-26 16:56 -------- d-----w- c:\documents and settings\user321\Application Data\IDM
2009-07-24 19:47 . 2009-07-24 19:47 -------- dc----w- c:\documents and settings\All Users\Application Data\{81D4BDA8-1F33-4633-B176-8A7E942ABDE1}
2009-07-22 20:50 . 2009-07-22 20:50 603904 ----a-w- c:\windows\system32\TUProgSt.exe
2009-07-22 20:50 . 2008-11-12 12:44 27904 ----a-w- c:\windows\system32\uxtuneup.dll
2009-07-22 20:50 . 2009-07-22 20:50 362240 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-07-22 20:50 . 2009-07-23 09:32 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-07-22 15:15 . 2009-07-22 15:15 294912 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\ThinstallBuilder\4000003e00003i\snapshot.exe
2009-07-21 15:26 . 2009-08-03 12:24 -------- d-----w- c:\documents and settings\All Users\Application Data\SWiSHMax2WorkFolder
2009-07-21 09:48 . 2009-07-21 09:48 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\DSL Speed V4.8\10000001400002i\notepad.exe
2009-07-20 16:34 . 2009-07-20 16:34 -------- d-----w- c:\documents and settings\user321\Application Data\IndigoRose
2009-07-17 21:39 . 2002-12-27 15:33 20569 ----a-w- c:\windows\system32\PXC25pm.dll
2009-07-17 17:43 . 2009-07-17 17:52 -------- d-----w- c:\documents and settings\user321\Local Settings\Application Data\Adobe
2009-07-17 10:42 . 2009-07-17 10:42 -------- d-----w- c:\documents and settings\user321\Application Data\Ipswitch
2009-07-17 10:42 . 2009-07-17 10:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Ipswitch
2009-07-17 10:42 . 2009-05-13 06:33 1060864 ----a-w- c:\windows\system32\MFC71.dll
2009-07-17 10:42 . 2009-05-13 06:32 50688 ----a-w- c:\windows\system32\wbhelp2.dll
2009-07-17 10:42 . 2009-07-17 10:42 -------- d-----w- c:\program files\Ipswitch
2009-07-17 10:17 . 2009-07-17 10:29 -------- d-----w- c:\documents and settings\user321\Application Data\Notepad++
2009-07-16 19:04 . 2009-07-16 19:04 8704 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\PHOTOSHOP\400000d5300002h\ImageReady.exe
2009-07-16 11:54 . 2009-07-16 11:54 8704 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\PHOTOSHOP\1000000b00002h\rundll32.exe
2009-07-15 17:52 . 2009-07-15 17:52 -------- d-----w- c:\documents and settings\user321\Application Data\Downloaded Installations
2009-07-15 09:03 . 2009-07-15 09:03 -------- d-----w- c:\documents and settings\user321\Application Data\FastStone
2009-07-15 00:29 . 2009-07-15 00:29 45056 ----a-r- c:\documents and settings\user321\Application Data\Microsoft\Installer\{6815FCDD-401D-481E-BA88-31B4754C2B46}\ARPPRODUCTICON.exe
2009-07-14 17:01 . 2004-08-03 18:58 100992 ----a-w- c:\windows\system32\drivers\bthpan.sys
2009-07-14 17:00 . 2004-08-03 20:56 152576 ----a-w- c:\windows\system32\irftp.exe
2009-07-14 17:00 . 2004-08-03 19:10 59648 ----a-w- c:\windows\system32\drivers\rfcomm.sys
2009-07-14 17:00 . 2004-08-03 19:10 17024 ----a-w- c:\windows\system32\drivers\BthEnum.sys
2009-07-14 17:00 . 2004-08-03 20:56 8192 ----a-w- c:\windows\system32\wshirda.dll
2009-07-14 17:00 . 2004-08-03 19:10 274304 ----a-w- c:\windows\system32\drivers\bthport.sys
2009-07-14 17:00 . 2004-08-03 19:10 18944 ----a-w- c:\windows\system32\drivers\BTHUSB.SYS
2009-07-13 06:11 . 2009-07-13 06:11 7168 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\PdfGrabber 4.0\30000000baa00002i\WINWORD.EXE
2009-07-13 06:09 . 2009-07-13 06:09 7168 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\PdfGrabber 4.0\40000069900002i\PdfGrabber.exe
2009-07-13 01:38 . 2009-07-13 01:38 7168 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\Ashampoo Magical Optimizer\10000006600002i\REGEDIT.exe
2009-07-13 01:16 . 2009-07-13 01:16 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\DSL Speed V4.8\4000008000002i\Splash Screen.exe
2009-07-10 01:20 . 2009-07-10 01:20 -------- d--h--w- c:\windows\$hf_mig$
2009-07-09 07:42 . 2009-07-09 07:42 7168 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\Ashampoo Magical Optimizer\40000019800002i\AMO.exe
2009-07-08 05:09 . 2009-07-23 08:46 -------- d-----w- c:\documents and settings\user321\Local Settings\Application Data\Ashampoo Music Studio 3
2009-07-05 16:10 . 2009-07-05 16:10 -------- d-----w- c:\documents and settings\user321\Local Settings\Application Data\Google
2009-07-04 21:20 . 2009-07-04 21:20 -------- d-----w- c:\documents and settings\user321\Local Settings\Application Data\Mayoko
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-03 15:07 . 2008-02-28 15:13 53064736 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-08-03 15:06 . 2008-02-28 15:13 3386656 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-08-03 15:05 . 2008-02-28 15:13 322700 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-08-03 15:05 . 2008-02-28 15:13 717932 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-08-03 14:44 . 2008-02-28 15:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-08-01 21:33 . 2009-04-13 08:29 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-01 21:29 . 2009-03-30 15:56 -------- d-----w- c:\documents and settings\user321\Application Data\Thinstall
2009-08-01 20:20 . 2009-02-28 15:24 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore
2009-08-01 09:16 . 2009-02-28 15:20 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-08-01 07:31 . 2009-06-13 12:28 -------- d-----w- c:\program files\Your Uninstaller 2008
2009-07-31 09:27 . 2009-05-30 09:35 -------- d-----w- c:\program files\Common Files\Real
2009-07-30 09:01 . 2009-02-26 00:04 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-23 08:46 . 2009-07-21 09:42 -------- d-----w- c:\documents and settings\user321\Application Data\zyzcleaner
2009-07-21 09:42 . 2009-07-21 09:42 -------- d-----w- c:\documents and settings\user321\Application Data\CyberScrub
2009-07-05 13:30 . 2009-06-26 17:36 -------- d-----w- c:\documents and settings\All Users\Application Data\PrevxCSI
2009-07-04 10:28 . 2009-06-17 20:36 249856 ------w- c:\windows\Setup1.exe
2009-07-04 10:28 . 2009-06-17 20:36 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-07-02 12:19 . 2009-07-02 12:19 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\Wise Disk Cleaner 4 Professional v4.51\4000003e400002i\WiseDiskCleaner.exe
2009-07-02 11:27 . 2009-07-02 11:27 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\Advanced SystemCare 3\4000009200002i\Sup_DiskCleaner.exe
2009-07-01 19:54 . 2009-07-01 19:54 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\Wise Disk Cleaner 4 Professional v4.51\4000008000002i\Splash Screen.exe
2009-06-29 17:43 . 2009-06-29 17:42 1773568 ----a-w- c:\windows\system32\msgdiplus.dll
2009-06-29 15:40 . 2009-06-29 15:40 -------- d-----w- c:\documents and settings\user321\Application Data\3DFA
2009-06-29 15:16 . 2009-06-29 15:16 -------- d-----w- c:\documents and settings\user321\Application Data\Photo Collage Screensaver
2009-06-27 11:31 . 2009-06-27 11:31 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\ffdshow [rev 1723] [2007-12-24]\4000001100002i\RealOneMessageCenter.exe
2009-06-27 11:31 . 2009-06-27 11:31 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\ffdshow [rev 1723] [2007-12-24]\400000600002i\rphelperapp.exe
2009-06-27 11:31 . 2009-06-27 11:31 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\ffdshow [rev 1723] [2007-12-24]\4000008100002i\RealPlay.exe
2009-06-27 07:37 . 2009-06-27 07:37 -------- d-----w- c:\documents and settings\user321\Application Data\Godlike
2009-06-25 17:08 . 2009-06-25 17:03 -------- d-----w- c:\documents and settings\user321\Application Data\Daimler
2009-06-25 07:22 . 2009-06-25 07:22 8704 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\ASCII Art Generator 3.2.2\10000001400002i\NOTEPAD.EXE
2009-06-23 16:44 . 2009-06-23 16:44 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\Easy GIF Animator 4.8 Pro\10000005700002i\mspaint.exe
2009-06-23 16:11 . 2009-06-23 16:11 -------- d-----w- c:\documents and settings\user321\Application Data\Boost Windows
2009-06-23 15:39 . 2009-06-23 15:39 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\Loaris Trojan Remover 1.1\4000008000002i\Splash Screen.exe
2009-06-23 15:34 . 2009-06-23 15:34 0 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\Bug Doctor 3.0.3.8\%SystemSystem%\Ultra.dll
2009-06-23 10:38 . 2009-04-05 17:10 -------- d-----w- c:\program files\Common Files\Ahead
2009-06-21 15:35 . 2009-06-21 15:35 7168 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\{EB8C2B22-9813-4712-99E5-A15602B66160}\400000f900002i\racing.exe
2009-06-21 12:45 . 2009-06-21 12:45 7168 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\{EB8C2B22-9813-4712-99E5-A15602B66160}\4ad000006100003i\cmd.exe
2009-06-21 12:44 . 2009-06-21 12:44 7168 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\{EB8C2B22-9813-4712-99E5-A15602B66160}\400000200002i\RunHiddenConsole.exe
2009-06-21 11:25 . 2009-06-18 16:00 -------- d--h--w- c:\documents and settings\user321\Application Data\IFViewer
2009-06-21 09:50 . 2009-06-21 09:50 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\Arcade Race v1.2\4000008100002i\realplay.exe
2009-06-21 09:50 . 2009-06-21 09:50 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\Arcade Race v1.2\4000001900002i\iexplore.exe
2009-06-20 09:25 . 2009-06-20 09:25 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\Absolute MP3 Splitter version 2.7.2\4000008100002i\realplay.exe
2009-06-20 09:25 . 2009-06-20 09:25 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\Absolute MP3 Splitter version 2.7.2\4000001900002i\iexplore.exe
2009-06-20 09:25 . 2009-06-18 17:22 -------- d-----w- c:\documents and settings\user321\Application Data\Babylon
2009-06-20 08:10 . 2009-06-19 07:19 10 ----a-w- c:\windows\popcinfo.dat
2009-06-19 14:44 . 2009-06-19 14:44 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\Arcade Race v1.2\300000003400002i\dwwin.exe
2009-06-19 14:41 . 2009-06-19 14:41 7680 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\Arcade Race v1.2\40000019b900002i\arace.exe
2009-06-18 20:31 . 2009-06-18 20:31 7168 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\Microsoft Text-to-Speech Engine 4.0 (English)\4000005e00002i\vcmd.exe
2009-06-18 17:22 . 2009-06-18 17:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Babylon
2009-06-18 13:43 . 2009-06-18 13:43 7168 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\Air Guard Full\40000016d00002i\pa.exe
2009-06-18 09:57 . 2009-06-18 09:57 -------- d-----w- c:\program files\Common Files\SourceTec
2009-06-17 20:05 . 2009-06-17 20:05 66560 ----a-w- c:\windows\system32\realbap1.dll
2009-06-17 17:25 . 2009-06-17 17:25 -------- d-----w- c:\documents and settings\user321\Application Data\Nokia Multimedia Player
2009-06-17 17:20 . 2009-06-17 17:20 -------- d-----w- c:\program files\Common Files\PCSuite
2009-06-16 17:50 . 2009-06-16 17:50 7168 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\VideoAvatar\300000003400002i\dwwin.exe
2009-06-16 17:50 . 2009-06-16 17:50 7168 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\VideoAvatar\40000043400002i\mplayerc.exe
2009-06-16 17:48 . 2009-06-16 17:48 7168 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\VideoAvatar\1000000b00002i\rundll32.exe
2009-06-15 10:50 . 2009-06-15 10:50 -------- d-----w- c:\program files\Common Files\xing shared
2009-06-15 10:50 . 2009-06-10 06:45 -------- d-----w- c:\program files\Real
2009-06-15 10:50 . 2009-06-15 10:50 214560 ----a-w- c:\documents and settings\user321\Application Data\Thinstall\ffdshow [rev 1723] [2007-12-24]\%ProgramFilesDir%\Real\RealPlayer\realplay.exe
2009-06-15 10:50 . 2009-06-15 10:50 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-06-15 10:50 . 2009-06-13 06:29 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-06-15 10:37 . 2009-06-15 10:37 -------- d-----w- c:\documents and settings\user321\Application Data\Ectaco
2009-06-13 07:57 . 2009-06-13 07:57 -------- d-----w- c:\program files\Apple Software Update
2009-06-13 07:57 . 2009-06-13 07:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-06-12 07:05 . 2009-06-12 07:05 256 -c--a-w- c:\windows\system32\CablexDSL.dat
2009-06-10 06:42 . 2009-06-10 06:42 -------- d-----w- c:\documents and settings\user321\Application Data\GeoVid
2009-06-09 15:22 . 2009-06-09 15:22 -------- d-----w- c:\documents and settings\user321\Application Data\Mask Surf
2009-06-09 09:09 . 2009-06-09 09:09 16384 -c--a-w- c:\documents and settings\user321\Application Data\Thinstall\GreenBox 1.0\400000c400002i\GreenBox.exe
2009-06-09 09:06 . 2009-06-09 09:06 8704 -c--a-w- c:\documents and settings\user321\Application Data\Thinstall\Flash Movie Player 1.5\400000f800002h\fmp.exe
2009-06-09 08:53 . 2009-06-09 08:53 7168 -c--a-w- c:\documents and settings\user321\Application Data\Thinstall\Batch Watermark Creator 6.2\40000023a00002i\BWC.exe
2009-06-09 08:53 . 2009-06-09 08:53 -------- d-----w- c:\documents and settings\user321\Application Data\URSoft
2009-06-09 08:53 . 2009-06-09 08:53 7168 -c--a-w- c:\documents and settings\user321\Application Data\Thinstall\Your Uninstaller! 2008 Version 6.0\40000051b00002i\uruninstaller.exe
2009-06-09 08:48 . 2009-06-09 08:48 -------- d-----w- c:\documents and settings\user321\Application Data\TypingMaster7
2009-06-09 08:48 . 2009-06-09 08:48 7168 -c--a-w- c:\documents and settings\user321\Application Data\Thinstall\TypingMaster Pro\40000038400002i\tmaster.exe
2009-06-09 08:24 . 2009-06-09 08:24 7168 -c--a-w- c:\documents and settings\user321\Application Data\Thinstall\Reg Organizer 4.21 beta 3\10000006600002i\regedit.exe
2009-06-09 08:24 . 2009-06-09 08:24 7168 -c--a-w- c:\documents and settings\user321\Application Data\Thinstall\Reg Organizer 4.21 beta 3\4000002af00002i\RegOrganizerAdmin.exe
2009-06-09 07:58 . 2009-06-09 07:58 7168 -c--a-w- c:\documents and settings\user321\Application Data\Thinstall\RamCleaner\40000028100002i\RamCleaner.exe
2009-06-09 07:54 . 2009-06-09 07:54 601088 -c--a-w- c:\documents and settings\user321\Application Data\Thinstall\PTGui Pro 7.8\4000005d200002i\PTGui.exe
2009-06-09 07:52 . 2009-06-09 07:51 -------- d-----w- c:\documents and settings\user321\Application Data\PasswordZilla
2009-06-09 07:51 . 2009-06-09 07:51 12800 -c--a-w- c:\documents and settings\user321\Application Data\Thinstall\PasswordZilla 2.3\4000008d00002i\PasswordZilla.exe
2009-06-09 07:46 . 2009-06-09 07:46 7168 -c--a-w- c:\documents and settings\user321\Application Data\Thinstall\Error Repair Professional 3.8.3\40000031600002i\ErrorRepairProfessional.exe
2009-06-09 07:45 . 2009-06-09 07:45 7168 -c--a-w- c:\documents and settings\user321\Application Data\Thinstall\DriverMax 4\4000005a400002i\devices.exe
2009-06-09 07:44 . 2009-06-09 07:44 7168 -c--a-w- c:\documents and settings\user321\Application Data\Thinstall\AusLogics Emergency Recovery\400000c400002i\recovery.exe
2009-06-09 07:25 . 2009-06-09 07:25 7168 -c--a-w- c:\documents and settings\user321\Application Data\Thinstall\Winamp (remove only)\40000010100002i\winamp.exe
2009-06-09 07:23 . 2009-06-09 07:23 86528 -c--a-w- c:\documents and settings\user321\Application Data\Thinstall\RealJukebox 1.0\4000008100002i\realplay.exe
2009-06-09 07:22 . 2009-06-09 07:22 -------- d-----w- c:\documents and settings\user321\Application Data\Topaz Moment
2009-06-09 07:19 . 2009-06-09 07:19 110592 -c--a-w- c:\documents and settings\user321\Application Data\Thinstall\COWON Media Center - jetAudio Plus VX\40000012c00002i\jetUpdate.exe
2009-06-09 07:19 . 2009-06-09 07:19 110592 -c--a-w- c:\documents and settings\user321\Application Data\Thinstall\COWON Media Center - jetAudio Plus VX\4000002b200002i\JetAudio.exe
2009-06-09 07:18 . 2009-06-09 07:18 -------- d-----w- c:\documents and settings\user321\Application Data\Vso
2009-06-09 07:17 . 2009-06-09 07:17 7168 -c--a-w- c:\documents and settings\user321\Application Data\Thinstall\ConvertXtoDVD 3.1.0.24\40000068700002i\ConvertXtoDvd.exe
2009-05-30 17:00 . 2009-07-21 09:42 625485 ----a-w- c:\documents and settings\user321\Application Data\zyzcleaner\run.exe
2009-05-28 03:35 . 2009-05-28 03:35 27648 -c--a-w- c:\documents and settings\user321\Application Data\Thinstall\AMUST Disk Cleaner 1.0\400000e700002i\RegCleaner.exe
2009-05-28 03:34 . 2009-05-28 03:34 27648 -c--a-w- c:\documents and settings\user321\Application Data\Thinstall\AMUST Disk Cleaner 1.0\40000010500002i\DiskCleaner.exe
2009-05-26 15:47 . 2009-02-26 00:00 80176 -c--a-w- c:\documents and settings\user321\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-20 15:16 . 2009-02-28 15:14 94643 -c--a-w- c:\windows\system32\drivers\klick.dat
2009-05-20 15:16 . 2009-02-28 15:14 105395 -c--a-w- c:\windows\system32\drivers\klin.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-05-23 15360]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-10-27 3810544]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-05-23 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-05-23 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-05-23 455168]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-05-16 137752]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-05-16 162328]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-05-16 137752]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_09\bin\jusched.exe" [2006-09-07 49263]
"USB Antivirus"="c:\program files\USB Disk Security\USBGuard.exe" [2008-08-16 798720]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-15 185896]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2008-02-08 227856]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2007-05-06 405504]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-05-23 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-05-23 15360]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStartMenuSubFolders"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoPrinters"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\English\\setup.exe"=
"e:\\كتاب الدورة التعلم اللغة\\تعلم المحادثة باللغة الانكليزية\\English\\ملفات التورنت للاسطوانات\\Portable ?Torrent v1.7.2\\utorrent.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Ipswitch\\WS_FTP 12\\wsftpgui.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [8/1/2009 1:16 PM 206096]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [7/23/2009 12:50 AM 603904]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [2/26/2009 4:18 AM 108032]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [12/13/2007 2:28 PM 24592]
R3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [2/26/2009 4:29 AM 194304]
S2 0027651249118199mcinstcleanup;McAfee Application Installer Cleanup (0027651249118199);c:\docume~1\user321\LOCALS~1\Temp\002765~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> c:\docume~1\user321\LOCALS~1\Temp\002765~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S3 zteusbser;ZTE USB Device for Legacy Serial Communication;c:\windows\system32\drivers\zteusbser.sys [3/5/2009 8:25 PM 99328]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
2009-08-03 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-20 12:28]
2009-07-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 10:57]
2009-08-03 c:\windows\Tasks\الصيانة بنقرة واحدة.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-20 12:28]
.
- - - - ORPHANS REMOVED - - - -
Notify-WgaLogon - (no file)
.
------- Supplementary Scan -------
.
uLocal Page = \blank.htm
uStart Page = hxxp://www.yahoo.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = 10.0.0.1:5555
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
IE: {{F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478}
TCP: {3B1FAAA1-1995-493A-83EB-61BEF677C41F} = 192.168.1.1
.
.
------- File Associations -------
.
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-08-03 19:07
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\sccfg.sys 20 bytes
scan completed successfully
hidden files: 1
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1292)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\windows\system32\klogon.dll
- - - - - - - > 'lsass.exe'(1348)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll
- - - - - - - > 'explorer.exe'(3388)
c:\program files\McAfee\SiteAdvisor\saHook.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\scardsvr.exe
c:\windows\system32\vssvc.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2009-08-03 19:09 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-03 15:09
Pre-Run: 35,155,447,808 bytes free
Post-Run: 35,128,860,672 bytes free
323
.png)
.png)
