هلا اخوي ماااكس ..
اشكرك ع سرعة التجاوب ..
ياغالي طبقت اللي قلته لي بحذافيره ولا زالت المشكله قائمه ..
ComboFix 09-11-25.05 - Owner 11/27/2009 1:31.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1033.18.2037.1601 [GMT 3:00]
Running from: c:\documents and settings\Owner\My Documents\أدوات حماية\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
D:\install.exe
.
((((((((((((((((((((((((( Files Created from 2009-10-26 to 2009-11-26 )))))))))))))))))))))))))))))))
.
2009-11-26 22:36 . 2009-11-26 22:36 -------- d-----w- c:\windows\system32\xircom
2009-11-26 22:36 . 2009-11-26 22:36 -------- d-----w- c:\windows\system32\wbem\snmp
2009-11-26 22:36 . 2009-11-26 22:36 -------- d-----w- c:\windows\system32\oobe
2009-11-26 22:36 . 2009-11-26 22:36 -------- d-----w- c:\program files\microsoft frontpage
2009-11-26 22:09 . 2009-11-26 22:09 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-11-26 22:09 . 2009-11-26 22:09 -------- d-----w- c:\documents and settings\Owner\Application Data\skypePM
2009-11-26 22:06 . 2009-11-26 22:06 -------- d-----w- c:\windows\system32\LogFiles
2009-11-26 22:02 . 2009-11-26 22:02 -------- d-----w- c:\program files\UltraVPN
2009-11-26 21:48 . 2002-10-02 06:57 13532 ----a-w- c:\windows\system32\drivers\SjyPkt.sys
2009-11-26 21:48 . 2009-11-26 21:48 -------- d-----w- c:\program files\REALTEK RTL8187 Wireless LAN Driver and Utility
2009-11-26 21:48 . 2009-11-26 21:48 -------- d-----w- c:\windows\OPTIONS
2009-11-26 21:37 . 2007-01-11 10:20 194304 ----a-r- c:\windows\system32\drivers\RTL8187.sys
2009-11-26 21:37 . 2009-11-26 21:37 21035 ----a-w- c:\windows\system32\drivers\AegisP.sys
2009-11-26 21:36 . 2007-02-01 07:36 306560 ------r- c:\windows\system32\drivers\rtl8185.sys
2009-11-26 21:36 . 2006-11-15 13:23 38144 ----a-w- c:\windows\system32\drivers\EAPPkt.sys
2009-11-26 21:36 . 2009-11-26 21:37 -------- d-----w- c:\program files\REALTEK PCI&Cardbus Wireless LAN Driver and Utility
2009-11-26 21:36 . 2009-11-26 21:36 -------- d-----w- c:\windows\system32\REALTEK PCI&Cardbus Wireless LAN Driver and Utility
2009-11-26 21:19 . 2009-11-26 21:19 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-11-26 21:10 . 2009-11-26 21:11 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip
2009-11-26 20:49 . 2009-11-26 22:27 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Runscanner.net
2009-11-26 20:31 . 2009-11-26 20:31 -------- d-----w- c:\documents and settings\All Users\Application Data\TechSmith
2009-11-26 20:31 . 2009-11-26 20:31 -------- d-----w- c:\program files\TechSmith
2009-11-26 20:31 . 2009-11-26 20:31 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\TechSmith
2009-11-26 14:11 . 2009-11-26 14:11 -------- d-----w- c:\program files\Microsoft.NET
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-26 22:37 . 2009-11-26 02:00 21536 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-11-26 22:37 . 2009-11-26 02:00 32 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-11-26 22:36 . 2009-11-26 02:00 41248 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-11-26 22:36 . 2009-11-26 01:31 684032 ----a-w- c:\documents and settings\All Users\Application Data\Lies shim upload curb\MPEG IDOL.exe
2009-11-26 22:36 . 2009-11-25 23:51 -------- d-----w- c:\documents and settings\Owner\Application Data\DMCache
2009-11-26 22:35 . 2009-11-26 02:00 5936 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-11-26 22:33 . 2009-11-26 00:15 -------- d-----w- c:\documents and settings\Owner\Application Data\Skype
2009-11-26 21:48 . 2009-11-26 00:03 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-26 21:48 . 2009-11-26 00:03 -------- d-----w- c:\program files\Common Files\InstallShield
2009-11-26 21:45 . 2009-11-26 02:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-11-26 20:39 . 2009-11-26 07:15 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-11-26 20:31 . 2009-11-26 00:21 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-11-26 14:23 . 2009-11-25 23:51 -------- d-----w- c:\documents and settings\Owner\Application Data\IDM
2009-11-26 14:12 . 2009-11-26 01:00 53240 ----a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-26 07:32 . 2009-11-26 07:32 -------- d-----w- c:\program files\7-Zip
2009-11-26 07:32 . 2009-11-26 07:32 -------- d-----w- c:\program files\Foxit Software
2009-11-26 07:32 . 2009-11-26 07:32 -------- d-----w- c:\documents and settings\Owner\Application Data\Foxit
2009-11-26 07:32 . 2009-11-26 07:32 318 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{A7050037-F0EA-4BAB-BCD5-FC05507D6147}\ARPPRODUCTICON.exe
2009-11-26 07:32 . 2009-11-26 07:32 25214 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{FF77941A-2BFA-4A18-BE2E-69B9498E4D55}\_294823.exe
2009-11-26 07:32 . 2009-11-26 07:32 -------- d-----w- c:\program files\UPHClean
2009-11-26 07:31 . 2009-11-26 07:32 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-26 07:30 . 2009-11-26 07:30 94248 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-11-26 07:30 . 2009-11-26 07:30 -------- d-----w- c:\program files\MSBuild
2009-11-26 07:30 . 2009-11-26 07:30 -------- d-----w- c:\program files\Reference Assemblies
2009-11-26 07:16 . 2009-11-26 07:16 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-11-26 07:14 . 2009-11-26 07:14 -------- d-----w- c:\program files\Windows Media Connect 2
2009-11-26 07:13 . 2009-11-26 07:13 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-11-26 07:12 . 2009-11-26 07:12 -------- d-----w- c:\program files\MSXML 4.0
2009-11-26 07:12 . 2009-11-26 07:12 -------- d-----w- c:\program files\Microsoft Silverlight
2009-11-26 02:37 . 2009-11-26 01:27 -------- d-----w- c:\program files\Windows Live
2009-11-26 02:36 . 2009-11-26 02:35 -------- dcsh--w- c:\program files\Common Files\WindowsLiveInstaller
2009-11-26 02:35 . 2009-11-26 02:35 -------- d-----w- c:\documents and settings\All Users\Application Data\WLInstaller
2009-11-26 02:24 . 2007-10-31 10:41 112144 ----a-w- c:\windows\system32\drivers\kl1.sys
2009-11-26 02:24 . 2009-11-26 02:00 95259 ----a-w- c:\windows\system32\drivers\klick.dat
2009-11-26 02:24 . 2009-11-26 02:00 108059 ----a-w- c:\windows\system32\drivers\klin.dat
2009-11-26 02:24 . 2009-11-26 02:24 25104 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP7\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav6\7.0.1.321\ushata.dll
2009-11-26 02:24 . 2009-11-26 02:24 112144 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP7\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav6\7.0.1.321\X86\kl1.sys
2009-11-26 02:24 . 2009-11-26 02:24 772624 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP7\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav6\7.0.1.321\updater.dll
2009-11-26 02:23 . 2009-11-26 02:23 150032 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP7\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav6\7.0.1.321\diffs.dll
2009-11-26 02:23 . 2009-11-26 02:23 354832 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP7\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav6\7.0.1.321\ckahum.dll
2009-11-26 02:00 . 2009-11-26 02:00 -------- d-----w- c:\program files\Kaspersky Lab
2009-11-26 01:58 . 2009-11-26 01:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-11-26 01:42 . 2009-11-26 01:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-11-26 01:38 . 2009-11-26 01:38 -------- d-----w- c:\program files\WinPcap
2009-11-26 01:38 . 2009-11-26 01:29 -------- d-----w- c:\program files\Messenger Plus! Live
2009-11-26 01:31 . 2009-11-26 01:31 229376 ----a-w- c:\documents and settings\Owner\Application Data\OPTIONHOLE\Audio Style Rect.exe
2009-11-26 01:31 . 2009-11-26 01:30 -------- d-----w- c:\documents and settings\Owner\Application Data\OPTIONHOLE
2009-11-26 01:31 . 2009-11-26 01:31 290816 ----a-w- c:\documents and settings\Owner\Application Data\OPTIONHOLE\Surf Long Hold Site.exe
2009-11-26 01:31 . 2009-11-26 01:31 684032 ----a-w- c:\documents and settings\Owner\Application Data\OPTIONHOLE\tpbrkjjw.exe
2009-11-26 01:31 . 2009-11-26 01:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Lies shim upload curb
2009-11-26 01:30 . 2009-11-26 01:30 -------- d-----w- c:\program files\OPTIONHOLE
2009-11-26 01:30 . 2009-11-26 01:30 479232 ----a-w- c:\documents and settings\Owner\Application Data\OPTIONHOLE\onceknob.exe
2009-11-26 01:29 . 2009-11-26 01:29 -------- d-----w- c:\program files\Circle Developemnt
2009-11-26 01:27 . 2009-11-26 01:27 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-11-26 01:21 . 2009-11-26 07:32 -------- d-----w- c:\program files\Unlocker
2009-11-26 01:00 . 2009-11-26 01:00 -------- d-----w- c:\program files\Common Files\Windows Live
2009-11-26 00:46 . 2009-11-26 00:18 -------- d-----w- c:\program files\DynDNS Updater
2009-11-26 00:45 . 2009-11-26 00:45 732120 ----a-w- c:\documents and settings\All Users\Application Data\DynDNS\Updater\setup.exe
2009-11-26 00:40 . 2009-11-26 00:40 1591113 ----a-w- c:\documents and settings\Owner\Application Data\IDM\DwnlData\Owner\busdriver_setup_7\busdriver_setup.exe
2009-11-26 00:37 . 2009-11-26 00:37 -------- d-----w- c:\program files\Realtek AC97
2009-11-26 00:34 . 2009-11-26 00:17 -------- d-----w- c:\program files\JetAudio
2009-11-26 00:32 . 2009-11-26 00:32 251952 ----a-w- c:\documents and settings\Owner\Application Data\IDM\DwnlData\Owner\Win2kxp_4\Win2kxp.exe
2009-11-26 00:25 . 2009-11-26 00:25 -------- d-----w- c:\documents and settings\Owner\Application Data\COWON
2009-11-26 00:19 . 2009-11-26 00:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-11-26 00:18 . 2009-11-26 00:18 -------- d-----w- c:\documents and settings\All Users\Application Data\DynDNS
2009-11-26 00:17 . 2009-11-26 00:17 -------- d-----w- c:\program files\Common Files\COWON
2009-11-26 00:17 . 2009-11-26 00:17 -------- d-----w- c:\documents and settings\Owner\Application Data\InstallShield
2009-11-26 00:14 . 2009-11-26 00:14 -------- d-----w- c:\program files\Skype
2009-11-26 00:14 . 2009-11-26 00:14 -------- d-----w- c:\program files\Common Files\Skype
2009-11-26 00:14 . 2009-11-26 00:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-10-23 05:37 . 2009-11-26 07:28 3234 ----a-w- c:\documents and settings\Custom Settings\User Settings.bat
2009-10-23 04:21 . 2009-11-26 07:28 2312 ----a-w- c:\documents and settings\Custom Settings\System Settings.bat
2009-10-23 01:14 . 2009-11-26 07:28 15179 ----a-w- c:\documents and settings\Custom Settings\IE Favorite Links.bat
2009-10-22 23:34 . 2009-11-26 07:28 30951 ----a-w- c:\documents and settings\Custom Settings\System Settings.reg
2009-10-19 08:50 . 2009-10-19 08:50 3186 ----a-w- c:\windows\system32\presetup.cmd
2009-10-19 08:50 . 2009-10-19 08:50 28672 ----a-w- c:\windows\system32\setupold.exe
2009-10-19 08:39 . 2001-08-17 20:37 77891 ----a-w- c:\windows\system32\usrmlnka.exe
2009-10-19 08:35 . 2009-10-19 08:35 361600 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-10-19 08:35 . 2009-10-19 08:35 218624 ----a-w- c:\windows\system32\uxtheme.dll
2009-10-19 08:35 . 2009-10-19 08:35 140288 ----a-w- c:\windows\system32\sfc_os.dll
2009-10-19 08:35 . 2009-10-19 06:35 990208 ----a-w- c:\windows\system32\syssetup.dll
2009-10-19 08:32 . 2009-10-19 08:32 4096 ----a-w- c:\windows\system32\xpsp4res.dll
2009-10-19 08:31 . 2009-10-19 08:31 63488 ----a-w- c:\windows\system32\wpdmtpus.dll
2009-10-19 08:30 . 2009-11-26 07:12 323696 ----a-w- c:\windows\system32\msdrm.dll
2009-10-19 08:30 . 2009-10-19 08:30 312128 ----a-w- c:\windows\system32\msdelta.dll
2009-10-19 08:30 . 2009-10-19 08:30 265720 ----a-w- c:\windows\system32\msdbg2.dll
2009-10-19 08:30 . 2009-10-19 08:30 317440 ----a-w- c:\windows\system32\mp4sdecd.dll
2009-10-19 08:30 . 2009-10-19 08:30 259072 ----a-w- c:\windows\system32\mpg4decd.dll
2009-10-19 08:30 . 2009-10-19 08:30 259072 ----a-w- c:\windows\system32\mp43decd.dll
2009-10-19 08:30 . 2009-10-19 08:30 212992 ----a-w- c:\windows\system32\mfplat.dll
2009-10-19 08:28 . 2009-11-26 07:12 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2009-10-19 08:27 . 2009-11-26 07:14 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-10-19 08:26 . 2009-10-19 08:26 985088 ----a-w- c:\windows\system32\setupapi.dll
2009-10-19 08:25 . 2009-10-19 08:25 330752 ----a-w- c:\windows\system32\ipnathlp.dll
2009-10-19 08:22 . 2009-10-19 08:22 1172 ----a-w- c:\windows\system32\nlite.cmd
2009-10-17 20:12 . 2009-11-26 07:28 31321 ----a-w- c:\documents and settings\Custom Settings\User Settings.reg
2009-10-08 06:24 . 2009-11-26 00:03 352256 ----a-w- c:\windows\vncutil.exe
2009-09-09 10:43 . 2009-11-11 14:10 210352 ----a-w- c:\windows\system32\idmmbc.dll
2009-09-04 22:43 . 2009-11-26 07:11 195712 ----a-w- c:\windows\system32\drivers\rdpdr.sys
.
------- Sigcheck -------
[-] 2009-10-19 . BA8C046D98345129723E6BCAA1E8AB99 . 361600 . . [5.1.2600.5649] . . c:\windows\system32\drivers\tcpip.sys
c:\windows\System32\wscntfy.exe ... is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-11-26 3171760]
"ByteMail"="c:\docume~1\Owner\APPLIC~1\OPTION~1\onceknob.exe" [2009-11-26 479232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"CoolSwitch"="c:\windows\system32\taskswitch.exe" [2002-03-19 45632]
"openvpn-gui"="c:\program files\UltraVPN\bin\openvpn-gui.exe" [2009-11-10 331365]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2008-02-08 227856]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-10-19 128512]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
DynDNS Updater Tray Icon.lnk - c:\program files\DynDNS Updater\DynTray.exe [2009-9-28 91504]
REALTEK PCI&Cardbus Wireless LAN Utility.lnk - c:\program files\REALTEK PCI&Cardbus Wireless LAN Driver and Utility\RtWLan.exe [2009-11-27 794624]
REALTEK RTL8187 Wireless LAN Utility.lnk - c:\program files\REALTEK RTL8187 Wireless LAN Driver and Utility\RtWLan.exe [2009-11-27 737280]
SnagIt 9.lnk - c:\program files\TechSmith\SnagIt 9\SnagIt32.exe [2008-5-15 6822728]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2009-11-18 495432]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"MaxRecentDocs"= 18 (0x12)
"NoSMConfigurePrograms"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\English\\setup.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R2 DynDNS Updater;DynDNS Updater;c:\program files\DynDNS Updater\DynUpSvc.exe [28/09/2009 03:38 م 99704]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [27/11/2009 12:36 ص 38144]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [13/12/2007 01:28 م 24592]
S1 DumpDrv;Crash Dump Driver;c:\windows\system32\drivers\dumpdrv.sys [19/10/2009 11:29 ص 9472]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [26/11/2009 03:03 ص 1684736]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [25/01/2007 08:31 م 42000]
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [27/11/2009 12:37 ص 194304]
S3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [27/11/2009 12:48 ص 13532]
--- Other Services/Drivers In Memory ---
*Deregistered* - uphcleanhlp
.
Contents of the 'Scheduled Tasks' folder
2009-11-26 c:\windows\Tasks\A84BEDFD91A8600D.job
- c:\docume~1\owner\applic~1\option~1\Audio Style Rect.exe [2009-11-26 01:31]
2009-11-26 c:\windows\Tasks\User_Feed_Synchronization-{D8F01C4A-7540-4E71-9811-4F8B6F2641B9}.job
- c:\windows\system32\msfeedssync.exe [2009-10-19 08:30]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
AddRemove-DynDNSUpdater - c:\program files\DynDNS Updater\Uninstall.exe {9C4AA4AF-DFA9-4ED0-98D1-96EE680A0FFC}
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-11-27 01:37
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1552)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\windows\system32\klogon.dll
- - - - - - - > 'lsass.exe'(1608)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll
- - - - - - - > 'explorer.exe'(3364)
c:\windows\system32\WININET.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\UPHClean\uphclean.exe
c:\program files\Internet Explorer\IEXPLORE.EXE
c:\program files\Internet Explorer\IEXPLORE.EXE
c:\program files\TechSmith\SnagIt 9\TSCHelp.exe
c:\program files\TechSmith\SnagIt 9\SnagPriv.exe
c:\program files\TechSmith\SnagIt 9\snagiteditor.exe
c:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 2009-11-27 01:38 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-26 22:38
Pre-Run: 44,033,904,640 bytes free
Post-Run: 44,117,966,848 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - D5F3BE4BDB3ECF299EB215F0E14ED5B2
.png)
.png)
