تفضل طال عمرك
ComboFix 09-08-04.04 - user 08/06/2009 3:41.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.965.1033.18.1022.743 [GMT 3:00]
Running from: c:\documents and settings\user\Desktop\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: <PRODUCT> *disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
FW: ESET Personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\أبوفيصل\Application Data\BITS
c:\documents and settings\أبوفيصل\Application Data\BITS\BITS.ini
c:\documents and settings\أبوفيصل\Application Data\BITS\DHTTable.dat
c:\documents and settings\أبوفيصل\Application Data\BITS\ProxyList.ini
c:\documents and settings\أبوفيصل\My Documents\خاص فيصل\العاب psp\بيبسي مان\Desktop_.ini
c:\documents and settings\user\Application Data\BITS
c:\documents and settings\user\Application Data\BITS\BITS.ini
c:\documents and settings\user\Application Data\BITS\DHTTable.dat
c:\documents and settings\user\Application Data\BITS\ProxyList.ini
c:\documents and settings\user\Application Data\BITS\UPnP.ini
c:\documents and settings\user\My Documents\خاص فيصل\العاب psp\بيبسي مان\Desktop_.ini
c:\recycler\S-1-5-21-4598888676-2949419987-118169150-1893
c:\windows\Installer\23723.msi
c:\windows\Installer\2d226.msi
c:\windows\Installer\4ae2e.msi
c:\windows\system32\coinst.dll
c:\windows\system32\drivers\SKYNETtoqxyiuw.sys
c:\windows\system32\kakle.dll
c:\windows\system32\ntUsrrP_1_0.dll
c:\windows\system32\SKYNETbowbavfh.dat
c:\windows\system32\SKYNETolemxbyk.dll
c:\windows\system32\SKYNETxgwugewi.dat
c:\windows\system32\SKYNETycrbejpi.dll
c:\windows\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job
c:\windows\Tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job
d:\copy my documents\خاص فيصل\العاب psp\بيبسي مان\Desktop_.ini
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_SKYNETmybwqqpl
-------\Legacy_CSNETMANAGERXP
((((((((((((((((((((((((( Files Created from 2009-07-06 to 2009-08-06 )))))))))))))))))))))))))))))))
.
2009-08-06 00:40 . 2009-08-06 00:40 604140 --sha-w- c:\windows\system32\drivers\ISwift3.dat
2009-08-06 00:05 . 2009-08-06 00:05 -------- d-----w- c:\program files\Trend Micro
2009-08-05 23:23 . 2009-05-29 21:31 881664 ----a-w- c:\windows\system32\xvidcore.dll
2009-08-05 23:23 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2009-08-05 23:23 . 2009-05-29 21:37 205824 ----a-w- c:\windows\system32\xvidvfw.dll
2009-08-05 23:23 . 2009-05-01 21:02 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-08-05 23:23 . 2009-05-01 21:02 685056 ----a-w- c:\windows\system32\divx.dll
2009-08-05 23:23 . 2008-11-06 16:37 3596288 ----a-w- c:\windows\system32\qt-dx331.dll
2009-08-05 23:23 . 2009-06-02 16:11 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2009-08-05 23:23 . 2009-01-07 18:14 60273 ----a-w- c:\windows\system32\pthreadGC2.dll
2009-08-05 23:23 . 2009-08-05 23:24 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-08-05 11:59 . 2009-08-05 11:59 94643 ----a-w- c:\windows\system32\drivers\klick.dat
2009-08-05 11:59 . 2009-08-05 11:59 105395 ----a-w- c:\windows\system32\drivers\klin.dat
2009-08-05 11:59 . 2009-08-05 11:59 -------- d-----w- c:\program files\Kaspersky Lab
2009-08-03 21:25 . 2009-08-03 21:25 3942048 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-08-03 21:21 . 2009-08-03 10:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 21:21 . 2009-08-03 21:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-03 21:21 . 2009-08-03 10:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-03 20:55 . 2009-08-03 20:55 -------- d-----w- c:\documents and settings\user\Application Data\Malwarebytes
2009-08-03 20:55 . 2009-08-03 20:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-03 18:01 . 2009-08-03 23:35 -------- d-----w- c:\documents and settings\All Users\Application Data\17878754
2009-08-01 02:52 . 2009-08-01 02:52 932368 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\profiles-1-6.dll
2009-08-01 02:52 . 2009-08-01 02:52 678416 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\content_interpreter-1-1.dll
2009-08-01 02:52 . 2009-08-01 02:52 604688 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\gsg-3-9.dll
2009-08-01 02:52 . 2009-08-01 02:52 522768 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\database-1-5.dll
2009-08-01 02:52 . 2009-08-01 02:52 1096208 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\filtration-4-6.dll
2009-08-01 02:33 . 2009-08-06 00:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-08-01 02:31 . 2009-08-01 02:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-07-31 01:17 . 2009-07-31 01:18 -------- d-----w- c:\program files\Formtec
2009-07-29 12:23 . 2009-07-29 12:24 16 ----a-w- c:\windows\popcinfo.dat
2009-07-29 12:14 . 2009-07-29 12:14 -------- d-----w- c:\documents and settings\All Users\Application Data\n7-89-o9-3r-4t-r9
2009-07-29 12:14 . 2009-07-29 12:14 -------- d-----w- c:\documents and settings\user\Application Data\GameHouse
2009-07-29 12:14 . 2009-07-29 12:14 -------- d-----w- c:\program files\GameHouse
2009-07-29 10:33 . 2009-07-03 17:09 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2009-07-29 10:33 . 2009-07-03 17:09 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-07-25 11:05 . 2009-07-25 11:06 -------- d-----w- c:\documents and settings\user\Application Data\Super-Cow
2009-07-25 10:55 . 2009-07-25 10:56 -------- d-----w- c:\documents and settings\أبوفيصل\Application Data\Super-Cow
2009-07-24 13:47 . 2009-07-24 14:05 -------- d-----w- c:\documents and settings\أبوفيصل\Application Data\SBMAV Disk Cleaner
2009-07-23 15:08 . 2009-07-24 13:36 -------- d-----w- c:\documents and settings\user\Application Data\SBMAV Disk Cleaner
2009-07-23 15:05 . 2009-07-23 15:05 -------- d-----w- c:\program files\SBMAV Disk Cleaner 2009
2009-07-18 00:51 . 2009-07-18 00:51 -------- d-----w- c:\documents and settings\user\Application Data\Thinstall
2009-07-16 13:16 . 2009-07-16 21:58 -------- d-----w- c:\program files\AutorunRemover
2009-07-09 15:52 . 2009-07-09 15:52 59992 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 2010 9.0.0.463\English\setup.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-03 23:35 . 2009-05-16 14:06 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-01 02:27 . 2009-07-04 04:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-07-31 01:16 . 2009-05-23 13:09 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-07-29 17:51 . 2009-05-27 06:37 -------- d-----w- c:\documents and settings\أبوفيصل\Application Data\PC Suite
2009-07-25 11:05 . 2009-05-10 12:50 -------- d-----w- c:\program files\Super Cow
2009-07-06 03:37 . 2009-07-06 03:37 -------- d-----w- c:\documents and settings\أبوفيصل\Application Data\Nitro PDF
2009-07-04 04:01 . 2009-07-04 04:01 -------- d-----w- c:\program files\Avira
2009-07-04 00:54 . 2009-05-09 20:38 -------- d-----w- c:\program files\Common Files\InstallShield
2009-07-04 00:54 . 2009-06-20 01:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Ulead Systems
2009-07-04 00:54 . 2009-05-09 20:38 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-03 17:09 . 2004-08-04 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-03 12:48 . 2009-07-03 12:48 219664 ----a-w- c:\windows\system32\klogon.dll
2009-07-03 12:45 . 2009-07-03 12:45 27507 ----a-w- c:\windows\system32\drivers\klopp.dat
2009-07-03 04:12 . 2009-07-03 04:12 -------- d-----w- c:\documents and settings\أبوفيصل\Application Data\ESET
2009-07-02 23:30 . 2009-07-02 23:30 -------- d-----w- c:\documents and settings\user\Application Data\ESET
2009-07-01 22:44 . 2009-07-01 22:40 -------- d-----w- c:\program files\Paint.NET
2009-06-29 17:03 . 2009-06-21 03:14 -------- d-----w- c:\documents and settings\أبوفيصل\Application Data\Nokia
2009-06-29 17:00 . 2009-05-25 21:39 -------- d-----w- c:\documents and settings\user\Application Data\PC Suite
2009-06-29 16:59 . 2009-06-29 16:59 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-06-29 16:59 . 2009-06-29 16:59 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-06-27 03:11 . 2009-06-27 03:11 -------- d-----w- c:\documents and settings\user\Application Data\Internet Cleaner
2009-06-27 02:25 . 2009-06-27 02:24 -------- d-----w- c:\program files\Media Convert Master
2009-06-27 02:24 . 2009-05-09 20:43 -------- d-----w- c:\documents and settings\user\Application Data\Vso
2009-06-27 02:24 . 2009-05-09 20:43 81920 ----a-w- c:\documents and settings\user\Application Data\ezpinst.exe
2009-06-27 02:24 . 2009-05-09 20:43 81920 ----a-w- c:\documents and settings\user\Application Data\ezpinst.exe
2009-06-27 02:24 . 2009-05-09 20:43 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-06-27 02:24 . 2009-05-09 20:43 47360 ----a-w- c:\documents and settings\user\Application Data\pcouffin.sys
2009-06-27 02:24 . 2009-05-09 20:43 47360 ----a-w- c:\documents and settings\user\Application Data\pcouffin.sys
2009-06-25 23:46 . 2009-06-20 01:38 74 ---ha-w- c:\windows\efdcet.dat
2009-06-25 00:56 . 2009-06-25 00:56 -------- d-----w- c:\documents and settings\All Users\Application Data\XlinkSoft
2009-06-25 00:56 . 2009-06-25 00:56 -------- d-----w- c:\program files\XlinkSoft
2009-06-25 00:22 . 2009-06-25 00:22 626688 ----a-w- c:\documents and settings\All Users\Application Data\Torrent2Exe\msvcr80.dll
2009-06-25 00:22 . 2009-06-25 00:22 548864 ----a-w- c:\documents and settings\All Users\Application Data\Torrent2Exe\msvcp80.dll
2009-06-25 00:22 . 2009-06-25 00:22 1757184 ----a-w- c:\documents and settings\All Users\Application Data\Torrent2Exe\fdmbtsupp.dll
2009-06-25 00:22 . 2009-06-21 13:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Torrent2Exe
2009-06-24 22:21 . 2009-06-24 22:21 -------- d-----w- c:\documents and settings\أبوفيصل\Application Data\URSoft
2009-06-24 03:10 . 2009-06-20 18:50 -------- d-----w- c:\documents and settings\أبوفيصل\Application Data\Ulead Systems
2009-06-22 10:39 . 2009-06-22 10:39 93 ----a-w- c:\windows\system32\SKYNET.dat
2009-06-21 14:11 . 2009-06-21 14:08 -------- d-----w- c:\program files\FlashCapture
2009-06-20 18:35 . 2009-05-10 20:16 206488 ----a-w- c:\documents and settings\أبوفيصل\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-20 02:25 . 2009-06-20 02:25 -------- d-----w- c:\documents and settings\user\Application Data\Ulead Systems
2009-06-19 10:58 . 2009-05-09 20:18 206488 ----a-w- c:\documents and settings\user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-19 00:37 . 2009-06-19 00:28 -------- d-----w- c:\program files\Total Video Converter
2009-06-16 22:46 . 2009-05-09 20:42 -------- d-----w- c:\program files\Video Convert Master
2009-06-16 21:58 . 2009-06-16 21:58 -------- d-----w- c:\program files\Common Files\xing shared
2009-06-16 21:58 . 2009-05-09 20:41 -------- d-----w- c:\program files\Common Files\Real
2009-06-16 21:58 . 2009-05-09 20:41 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-06-16 21:03 . 2009-05-09 20:38 -------- d-----w- c:\program files\CyberLink
2009-06-16 14:36 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-04 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-15 23:54 . 2009-06-15 23:54 -------- d-----w- c:\documents and settings\user\Application Data\Nitro PDF
2009-06-15 23:21 . 2009-06-15 23:21 -------- d-----w- c:\program files\Nitro PDF
2009-06-15 23:21 . 2009-06-15 23:21 -------- d-----w- c:\program files\Common Files\Nitro PDF
2009-06-15 23:21 . 2009-06-15 23:21 -------- d-----w- c:\program files\Common Files\BCL Technologies
2009-06-15 23:21 . 2009-06-15 23:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Nitro PDF
2009-06-15 11:15 . 2009-06-11 13:45 -------- d-----w- c:\program files\VS Revo Group
2009-06-15 11:14 . 2009-05-09 20:33 -------- d-----w- c:\program files\Ahead
2009-06-15 11:01 . 2009-06-15 11:01 128016 ----a-w- c:\windows\system32\drivers\kl1.sys
2009-06-09 11:31 . 2009-05-16 14:06 -------- d-----w- c:\documents and settings\user\Application Data\ImageBadger
2009-06-03 19:09 . 2004-08-04 12:00 1291264 ----a-w- c:\windows\system32\quartz.dll
2009-06-02 18:36 . 2009-05-11 22:49 704384 ----a-w- c:\windows\system32\drivers\SandBox.sys
2009-05-25 21:35 . 2009-05-25 21:35 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}\Installer\CommonCustomActions\UninstCCD.exe
2009-05-25 21:35 . 2009-05-25 21:35 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-05-25 21:35 . 2009-05-25 21:35 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}\Installer\CommonCustomActions\UninstPCS.exe
2009-05-25 17:43 . 2009-05-25 21:35 34649904 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}\Nokia_PC_Suite_7_1_26_0_ara_web.exe
2009-05-20 17:39 . 2009-05-11 22:48 257432 ----a-w- c:\windows\system32\drivers\afwcore.sys
2009-05-16 17:59 . 2009-05-16 17:59 19472 ----a-w- c:\windows\system32\drivers\klmouflt.sys
2009-05-13 14:46 . 2009-05-13 14:46 31760 ----a-w- c:\windows\system32\drivers\klim5.sys
2009-05-10 20:07 . 2009-05-10 20:01 102262 ----a-w- c:\windows\hpoins05.dat
2009-05-10 17:05 . 2009-05-10 17:05 6292728 ----a-w- c:\windows\system32\ntx16531000.exe
2009-05-10 17:05 . 2009-05-10 17:05 6292728 ----a-w- c:\windows\system32\ntx16530437.exe
2009-05-10 10:45 . 2009-05-09 20:13 166455 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-09 20:44 . 2009-05-09 20:44 90112 ----a-w- c:\windows\system32\agsaami.dll
2009-05-09 20:44 . 2009-05-09 20:44 610304 ----a-w- c:\windows\system32\agsaamg.dll
2009-05-09 20:44 . 2009-05-09 20:44 372736 ----a-w- c:\windows\system32\agsaamc.dll
2009-05-09 20:44 . 2009-05-09 20:44 2535424 ----a-w- c:\windows\system32\agsaamj.dll
2009-05-09 20:44 . 2009-05-09 20:44 1986560 ----a-w- c:\windows\system32\akll.dll
2009-05-09 20:44 . 2009-05-09 20:44 196608 ----a-w- c:\windows\system32\maag.dll
2009-05-09 20:44 . 2009-05-09 20:44 1245184 ----a-w- c:\windows\system32\bkll.dll
2009-05-09 20:44 . 2009-05-09 20:44 1212416 ----a-w- c:\windows\system32\ckll.dll
2009-05-09 20:41 . 2009-05-09 20:41 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-05-09 20:35 . 2009-05-09 20:35 2232 ----a-w- c:\windows\java\Packages\Data\HZRPJBHB.DAT
2009-05-09 20:35 . 2009-05-09 20:35 155995 ----a-w- c:\windows\java\Packages\UVRL3FZN.ZIP
2009-05-09 20:35 . 2009-05-09 20:35 2678 ----a-w- c:\windows\java\Packages\Data\WBPNJ73H.DAT
2009-05-09 20:35 . 2009-05-09 20:35 2678 ----a-w- c:\windows\java\Packages\Data\LVBTF5BD.DAT
2009-05-09 20:35 . 2009-05-09 20:35 2678 ----a-w- c:\windows\java\Packages\Data\ARPFRFVR.DAT
2009-05-09 20:35 . 2009-05-09 20:35 2678 ----a-w- c:\windows\java\Packages\Data\9ZBPJ53L.DAT
2009-05-09 20:35 . 2009-05-09 20:35 2678 ----a-w- c:\windows\java\Packages\Data\BT7DJVRP.DAT
2009-05-09 20:34 . 2009-05-09 20:34 172032 ------w- c:\windows\Setup1.exe
2009-05-09 20:34 . 2009-05-09 20:34 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-05-09 20:11 . 2009-05-09 20:11 21640 ----a-w- c:\windows\system32\emptyregdb.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-03-20 1312256]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"USB Antivirus"="c:\program files\USB Disk Security\USBGuard.exe" [2008-07-13 753664]
"Nitro PDF Printer Monitor"="c:\program files\Nitro PDF\Professional\NitroPDFPrinterMonitor.exe" [2009-03-04 209216]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-07-03 303376]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Snagit 9.lnk - c:\program files\TechSmith\Snagit 9\Snagit32.exe [2009-4-17 7226184]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [15/12/2008 08:41 م 33808]
R1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [12/05/2009 01:49 ص 704384]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [12/05/2009 01:48 ص 31128]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [12/05/2009 01:48 ص 257432]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [13/05/2009 05:46 م 31760]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [16/05/2009 08:59 م 19472]
S2 acssrv;Agnitum Client Security Service;c:\progra~1\Agnitum\OUTPOS~1\acs.exe --> c:\progra~1\Agnitum\OUTPOS~1\acs.exe [?]
S2 ekrn;ESET Service;"c:\program files\ESET\ESET Smart Security\ekrn.exe" --> c:\program files\ESET\ESET Smart Security\ekrn.exe [?]
S3 ASWFilt;ASWFilt;c:\windows\system32\Filt\ASWFilt.dll [12/05/2009 01:49 ص 33920]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Nitro PDF Professional]
cscript //B "c:\program files\Nitro PDF\Professional\RemoveOldAddins.vbs"
.
Contents of the 'Scheduled Tasks' folder
2009-08-06 c:\windows\Tasks\User_Feed_Synchronization-{1B76BA66-B5B2-4B2D-815C-0F4EE55867AE}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 01:31]
2009-08-05 c:\windows\Tasks\User_Feed_Synchronization-{DAB1E0FB-458C-41FC-AE70-C156AB5DB57F}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 01:31]
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
HKCU-Run-Torrent2Exe[d488eb8fc117493bbf0c45caf9cc4a79190b9e43] - c:\documents and settings\user\My Documents\FlashCapture2.exe
HKLM-Run-OutpostFeedBack - c:\program files\Agnitum\Outpost Firewall Pro\feedback.exe
HKLM-Run-OutpostMonitor - c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe
HKLM-Run-TkBellExe - c:\program files\K-Lite Codec Pack\Real\Update_OB\realsched.exe
HKLM-Run-Ulead AutoDetector v2 - c:\program files\Common Files\Ulead Systems\AutoDetector\monitor.exe
HKLM-Run-AutorunRemover.exe - c:\program files\AutorunRemover\AutorunRemover.exe
HKLM-Run-17878754 - c:\documents and settings\All Users\Application Data\17878754\17878754.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Save F&lash with FlashCapture - c:\program files\FlashCapture\fciext.dll/FCIEXT.htm
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
disk not found C:\
please note that you need administrator rights to perform deep scan
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(1544)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_ara.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\HPZipm12.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\program files\TechSmith\Snagit 9\TscHelp.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\TechSmith\Snagit 9\SnagPriv.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
c:\program files\TechSmith\Snagit 9\SnagitEditor.exe
c:\windows\system32\WudfHost.exe
.
**************************************************************************
.
Completion time: 2009-08-06 3:52 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-06 00:52
Pre-Run: 44,450,783,232 bytes free
Post-Run: 44,345,610,240 bytes free
297 --- E O F --- 2009-07-29 17:51
s_startup
