مشكور
بارك الله فيكم
ده التقرير
ComboFix 08-06-09.7 - malk 06/10/2008 17:55:09.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1033.18.672 [GMT 3:00]
Running from: C:\Documents and Settings\malk\My Documents\Downloads\Programs\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\10191.exe
C:\WINDOWS\system32\102ca.exe
C:\WINDOWS\system32\104dd.exe
C:\WINDOWS\system32\10625.exe
C:\WINDOWS\system32\10654.exe
C:\WINDOWS\system32\106a2.exe
C:\WINDOWS\system32\10821ad.exe
C:\WINDOWS\system32\108313d.exe
C:\WINDOWS\system32\1083e1e.exe
C:\WINDOWS\system32\1084b8b.exe
C:\WINDOWS\system32\10857ff.exe
C:\WINDOWS\system32\10c20.exe
C:\WINDOWS\system32\111c7c4.exe
C:\WINDOWS\system32\111ebc7.exe
C:\WINDOWS\system32\1120385.exe
C:\WINDOWS\system32\11210c4.exe
C:\WINDOWS\system32\113d1.exe
C:\WINDOWS\system32\11d42bb.exe
C:\WINDOWS\system32\11d4eb2.exe
C:\WINDOWS\system32\11d5b64.exe
C:\WINDOWS\system32\11d71ab.exe
C:\WINDOWS\system32\11d7d34.exe
C:\WINDOWS\system32\121fa.exe
C:\WINDOWS\system32\1245b.exe
C:\WINDOWS\system32\12ecb.exe
C:\WINDOWS\system32\13265.exe
C:\WINDOWS\system32\13272fd.exe
C:\WINDOWS\system32\132955a.exe
C:\WINDOWS\system32\132c16b.exe
C:\WINDOWS\system32\132d7b2.exe
C:\WINDOWS\system32\132f7fc.exe
C:\WINDOWS\system32\1341b.exe
C:\WINDOWS\system32\13dee.exe
C:\WINDOWS\system32\13ed9.exe
C:\WINDOWS\system32\14772a9.exe
C:\WINDOWS\system32\1478798.exe
C:\WINDOWS\system32\1479851.exe
C:\WINDOWS\system32\147dc7e.exe
C:\WINDOWS\system32\147e72d.exe
C:\WINDOWS\system32\1480004.exe
C:\WINDOWS\system32\1480da0.exe
C:\WINDOWS\system32\148185e.exe
C:\WINDOWS\system32\14a23.exe
C:\WINDOWS\system32\14d21.exe
C:\WINDOWS\system32\15649.exe
C:\WINDOWS\system32\15cfe1a.exe
C:\WINDOWS\system32\15d0703.exe
C:\WINDOWS\system32\15d13c5.exe
C:\WINDOWS\system32\15d2113.exe
C:\WINDOWS\system32\15d2d96.exe
C:\WINDOWS\system32\15d57a.exe
C:\WINDOWS\system32\15df3e.exe
C:\WINDOWS\system32\15e374.exe
C:\WINDOWS\system32\15ec6d.exe
C:\WINDOWS\system32\15f92e.exe
C:\WINDOWS\system32\15fd84.exe
C:\WINDOWS\system32\16136d.exe
C:\WINDOWS\system32\161ad0.exe
C:\WINDOWS\system32\162290.exe
C:\WINDOWS\system32\162d3f.exe
C:\WINDOWS\system32\163703.exe
C:\WINDOWS\system32\1638d7.exe
C:\WINDOWS\system32\16397.exe
C:\WINDOWS\system32\1639b2.exe
C:\WINDOWS\system32\163db9.exe
C:\WINDOWS\system32\164858.exe
C:\WINDOWS\system32\164bb3.exe
C:\WINDOWS\system32\164e82.exe
C:\WINDOWS\system32\16524b.exe
C:\WINDOWS\system32\165875.exe
C:\WINDOWS\system32\165cda.exe
C:\WINDOWS\system32\1660d2.exe
C:\WINDOWS\system32\16666f.exe
C:\WINDOWS\system32\16685.exe
C:\WINDOWS\system32\166a4.exe
C:\WINDOWS\system32\167eaa.exe
C:\WINDOWS\system32\168c95.exe
C:\WINDOWS\system32\169cb2.exe
C:\WINDOWS\system32\16a7fc.exe
C:\WINDOWS\system32\16a993.exe
C:\WINDOWS\system32\16ade8.exe
C:\WINDOWS\system32\16b4be.exe
C:\WINDOWS\system32\16b819.exe
C:\WINDOWS\system32\16c577.exe
C:\WINDOWS\system32\16ced.exe
C:\WINDOWS\system32\170d7d.exe
C:\WINDOWS\system32\1721b02.exe
C:\WINDOWS\system32\17225b0.exe
C:\WINDOWS\system32\1723262.exe
C:\WINDOWS\system32\17240e9.exe
C:\WINDOWS\system32\1724d0e.exe
C:\WINDOWS\system32\1729fe.exe
C:\WINDOWS\system32\172c9.exe
C:\WINDOWS\system32\17374c.exe
C:\WINDOWS\system32\174ff4.exe
C:\WINDOWS\system32\175bdb.exe
C:\WINDOWS\system32\176b7b.exe
C:\WINDOWS\system32\1782ad.exe
C:\WINDOWS\system32\179d59.exe
C:\WINDOWS\system32\17abe0.exe
C:\WINDOWS\system32\17b8ff.exe
C:\WINDOWS\system32\17e242.exe
C:\WINDOWS\system32\17f712.exe
C:\WINDOWS\system32\180172.exe
C:\WINDOWS\system32\1816af.exe
C:\WINDOWS\system32\1818f2.exe
C:\WINDOWS\system32\181f1c.exe
C:\WINDOWS\system32\182025.exe
C:\WINDOWS\system32\18246b.exe
C:\WINDOWS\system32\1824aa.exe
C:\WINDOWS\system32\18319a.exe
C:\WINDOWS\system32\183f94.exe
C:\WINDOWS\system32\187353b.exe
C:\WINDOWS\system32\1873d88.exe
C:\WINDOWS\system32\187477b.exe
C:\WINDOWS\system32\187549a.exe
C:\WINDOWS\system32\187610d.exe
C:\WINDOWS\system32\1877da.exe
C:\WINDOWS\system32\187c6e.exe
C:\WINDOWS\system32\18ab00.exe
C:\WINDOWS\system32\197853.exe
C:\WINDOWS\system32\19c4b6c.exe
C:\WINDOWS\system32\19c558e.exe
C:\WINDOWS\system32\19c6146.exe
C:\WINDOWS\system32\19c6eb3.exe
C:\WINDOWS\system32\19c7b75.exe
C:\WINDOWS\system32\1b1615f.exe
C:\WINDOWS\system32\1b17555.exe
C:\WINDOWS\system32\1b1814b.exe
C:\WINDOWS\system32\1b18f07.exe
C:\WINDOWS\system32\1b19b7a.exe
C:\WINDOWS\system32\1c67ed4.exe
C:\WINDOWS\system32\1c6885a.exe
C:\WINDOWS\system32\1c70838.exe
C:\WINDOWS\system32\1c715f4.exe
C:\WINDOWS\system32\1c72286.exe
C:\WINDOWS\system32\1dc0a64.exe
C:\WINDOWS\system32\1dc1c37.exe
C:\WINDOWS\system32\1dc27d0.exe
C:\WINDOWS\system32\1dc3fec.exe
C:\WINDOWS\system32\1dc4c6f.exe
C:\WINDOWS\system32\1f12c5e.exe
C:\WINDOWS\system32\1f1343d.exe
C:\WINDOWS\system32\1f13f49.exe
C:\WINDOWS\system32\1f1700e.exe
C:\WINDOWS\system32\1f17d1d.exe
C:\WINDOWS\system32\2065cfd.exe
C:\WINDOWS\system32\206677c.exe
C:\WINDOWS\system32\20673b1.exe
C:\WINDOWS\system32\2068228.exe
C:\WINDOWS\system32\2068e00.exe
C:\WINDOWS\system32\21b7e88.exe
C:\WINDOWS\system32\21b9387.exe
C:\WINDOWS\system32\21bb46d.exe
C:\WINDOWS\system32\21bdb2f.exe
C:\WINDOWS\system32\21bfe57.exe
C:\WINDOWS\system32\227866.exe
C:\WINDOWS\system32\22d1f0.exe
C:\WINDOWS\system32\22eb83.exe
C:\WINDOWS\system32\23132de.exe
C:\WINDOWS\system32\23137.exe
C:\WINDOWS\system32\2313bf6.exe
C:\WINDOWS\system32\2314899.exe
C:\WINDOWS\system32\2315664.exe
C:\WINDOWS\system32\2316ece.exe
C:\WINDOWS\system32\232ed.exe
C:\WINDOWS\system32\23dca.exe
C:\WINDOWS\system32\24452.exe
C:\WINDOWS\system32\24aea.exe
C:\WINDOWS\system32\24e06.exe
C:\WINDOWS\system32\25bb2.exe
C:\WINDOWS\system32\26622.exe
C:\WINDOWS\system32\26855.exe
C:\WINDOWS\system32\26a0a.exe
C:\WINDOWS\system32\28051.exe
C:\WINDOWS\system32\28dee.exe
C:\WINDOWS\system32\29754.exe
C:\WINDOWS\system32\2b2bd1.exe
C:\WINDOWS\system32\2b3d17.exe
C:\WINDOWS\system32\2b563d.exe
C:\WINDOWS\system32\2b5d03.exe
C:\WINDOWS\system32\2b61a6.exe
C:\WINDOWS\system32\2b6456.exe
C:\WINDOWS\system32\2b67ff.exe
C:\WINDOWS\system32\2b6d10.exe
C:\WINDOWS\system32\2b702d.exe
C:\WINDOWS\system32\2b754e.exe
C:\WINDOWS\system32\2b7c53.exe
C:\WINDOWS\system32\2b7d9b.exe
C:\WINDOWS\system32\2b7e85.exe
C:\WINDOWS\system32\2b8338.exe
C:\WINDOWS\system32\2b8a0e.exe
C:\WINDOWS\system32\2b8b08.exe
C:\WINDOWS\system32\2b8ee1.exe
C:\WINDOWS\system32\2bc34e.exe
C:\WINDOWS\system32\2bf53c.exe
C:\WINDOWS\system32\2c0326.exe
C:\WINDOWS\system32\2c1111.exe
C:\WINDOWS\system32\2c1da3.exe
C:\WINDOWS\system32\2c5964.exe
C:\WINDOWS\system32\2c6ec1.exe
C:\WINDOWS\system32\2c7e03.exe
C:\WINDOWS\system32\2c8c6b.exe
C:\WINDOWS\system32\2c996b.exe
C:\WINDOWS\system32\2ce77b.exe
C:\WINDOWS\system32\2d1794.exe
C:\WINDOWS\system32\2d648b.exe
C:\WINDOWS\system32\2d7dd0.exe
C:\WINDOWS\system32\2d8c66.exe
C:\WINDOWS\system32\2d9c45.exe
C:\WINDOWS\system32\2dbaaa.exe
C:\WINDOWS\system32\2dc7c9.exe
C:\WINDOWS\system32\2de3cd.exe
C:\WINDOWS\system32\2df1c7.exe
C:\WINDOWS\system32\2e783d.exe
C:\WINDOWS\system32\2e7ea6.exe
C:\WINDOWS\system32\2ed784.exe
C:\WINDOWS\system32\2edb4c.exe
C:\WINDOWS\system32\2ee8ca.exe
C:\WINDOWS\system32\2efbf4.exe
C:\WINDOWS\system32\2f337f.exe
C:\WINDOWS\system32\2f3776.exe
C:\WINDOWS\system32\2f683b.exe
C:\WINDOWS\system32\2f9cf7.exe
C:\WINDOWS\system32\2ff5c5.exe
C:\WINDOWS\system32\30110d.exe
C:\WINDOWS\system32\3084e.exe
C:\WINDOWS\system32\37e4c6.exe
C:\WINDOWS\system32\3801c4.exe
C:\WINDOWS\system32\380e76.exe
C:\WINDOWS\system32\39c9f.exe
C:\WINDOWS\system32\3af1d.exe
C:\WINDOWS\system32\407642.exe
C:\WINDOWS\system32\4078f1.exe
C:\WINDOWS\system32\407b33.exe
C:\WINDOWS\system32\407e12.exe
C:\WINDOWS\system32\4082d4.exe
C:\WINDOWS\system32\408574.exe
C:\WINDOWS\system32\408a47.exe
C:\WINDOWS\system32\409080.exe
C:\WINDOWS\system32\4097f3.exe
C:\WINDOWS\system32\4098ae.exe
C:\WINDOWS\system32\409c58.exe
C:\WINDOWS\system32\409dbf.exe
C:\WINDOWS\system32\40a61c.exe
C:\WINDOWS\system32\40aa23.exe
C:\WINDOWS\system32\40b118.exe
C:\WINDOWS\system32\40b2dd.exe
C:\WINDOWS\system32\4141df.exe
C:\WINDOWS\system32\415a0a.exe
C:\WINDOWS\system32\4174c6.exe
C:\WINDOWS\system32\418282.exe
C:\WINDOWS\system32\41a099.exe
C:\WINDOWS\system32\41add7.exe
C:\WINDOWS\system32\41bcfa.exe
C:\WINDOWS\system32\41caa6.exe
C:\WINDOWS\system32\424063.exe
C:\WINDOWS\system32\426427.exe
C:\WINDOWS\system32\42751f.exe
C:\WINDOWS\system32\428319.exe
C:\WINDOWS\system32\428fea.exe
C:\WINDOWS\system32\42bb9e.exe
C:\WINDOWS\system32\42dcd2.exe
C:\WINDOWS\system32\42f626.exe
C:\WINDOWS\system32\433dd.exe
C:\WINDOWS\system32\46e337.exe
C:\WINDOWS\system32\46f8f2.exe
C:\WINDOWS\system32\475980.exe
C:\WINDOWS\system32\476b72.exe
C:\WINDOWS\system32\47d3b2.exe
C:\WINDOWS\system32\482bc4.exe
C:\WINDOWS\system32\488416.exe
C:\WINDOWS\system32\489711.exe
C:\WINDOWS\system32\55adf5.exe
C:\WINDOWS\system32\55ba98.exe
C:\WINDOWS\system32\55d071.exe
C:\WINDOWS\system32\55dd33.exe
C:\WINDOWS\system32\56299.exe
C:\WINDOWS\system32\569efc.exe
C:\WINDOWS\system32\56ab51.exe
C:\WINDOWS\system32\56c188.exe
C:\WINDOWS\system32\56c1f6.exe
C:\WINDOWS\system32\56cd9e.exe
C:\WINDOWS\system32\56cf63.exe
C:\WINDOWS\system32\56dd8c.exe
C:\WINDOWS\system32\56ea5d.exe
C:\WINDOWS\system32\59a40f.exe
C:\WINDOWS\system32\5a0ab8.exe
C:\WINDOWS\system32\5a4d8d.exe
C:\WINDOWS\system32\5a893f.exe
C:\WINDOWS\system32\5ac211.exe
C:\WINDOWS\system32\5f62f2.exe
C:\WINDOWS\system32\5f8917.exe
C:\WINDOWS\system32\5fee0b.exe
C:\WINDOWS\system32\5ff416.exe
C:\WINDOWS\system32\606f41.exe
C:\WINDOWS\system32\6095b5.exe
C:\WINDOWS\system32\6af4fb.exe
C:\WINDOWS\system32\6b0e7e.exe
C:\WINDOWS\system32\6b1b11.exe
C:\WINDOWS\system32\6bdc2e.exe
C:\WINDOWS\system32\6beae4.exe
C:\WINDOWS\system32\6bf9b9.exe
C:\WINDOWS\system32\6c1e58.exe
C:\WINDOWS\system32\6c8a41.exe
C:\WINDOWS\system32\6ca73f.exe
C:\WINDOWS\system32\6cb3c2.exe
C:\WINDOWS\system32\70cbcb.exe
C:\WINDOWS\system32\70e732.exe
C:\WINDOWS\system32\70fb57.exe
C:\WINDOWS\system32\712c0b.exe
C:\WINDOWS\system32\713f84.exe
C:\WINDOWS\system32\76494.exe
C:\WINDOWS\system32\77d185.exe
C:\WINDOWS\system32\77ef5e.exe
C:\WINDOWS\system32\78578e.exe
C:\WINDOWS\system32\7867bb.exe
C:\WINDOWS\system32\78e45d.exe
C:\WINDOWS\system32\7945b7.exe
C:\WINDOWS\system32\80081f.exe
C:\WINDOWS\system32\801a9d.exe
C:\WINDOWS\system32\803ae7.exe
C:\WINDOWS\system32\804bb0.exe
C:\WINDOWS\system32\81a42b.exe
C:\WINDOWS\system32\81c30e.exe
C:\WINDOWS\system32\820ff5.exe
C:\WINDOWS\system32\823e29.exe
C:\WINDOWS\system32\86aec2.exe
C:\WINDOWS\system32\86c21b.exe
C:\WINDOWS\system32\86e34f.exe
C:\WINDOWS\system32\873826.exe
C:\WINDOWS\system32\877c43.exe
C:\WINDOWS\system32\955d2e.exe
C:\WINDOWS\system32\95c261.exe
C:\WINDOWS\system32\95e28b.exe
C:\WINDOWS\system32\9601cb.exe
C:\WINDOWS\system32\96aa11.exe
C:\WINDOWS\system32\96b089.exe
C:\WINDOWS\system32\96c25c.exe
C:\WINDOWS\system32\96cd68.exe
C:\WINDOWS\system32\9735a7.exe
C:\WINDOWS\system32\976013.exe
C:\WINDOWS\system32\97b93f.exe
C:\WINDOWS\system32\97eeb6.exe
C:\WINDOWS\system32\9ccbd4.exe
C:\WINDOWS\system32\9cee31.exe
C:\WINDOWS\system32\9d0d71.exe
C:\WINDOWS\system32\9d99c3.exe
C:\WINDOWS\system32\9e2b07.exe
C:\WINDOWS\system32\ab1906.exe
C:\WINDOWS\system32\ab31ed.exe
C:\WINDOWS\system32\ab43c0.exe
C:\WINDOWS\system32\ab51ba.exe
C:\WINDOWS\system32\b342ee.exe
C:\WINDOWS\system32\b34d9c.exe
C:\WINDOWS\system32\b35a9c.exe
C:\WINDOWS\system32\b36829.exe
C:\WINDOWS\system32\b3745e.exe
C:\WINDOWS\system32\c3076d.exe
C:\WINDOWS\system32\c32aa5.exe
C:\WINDOWS\system32\c336ab.exe
C:\WINDOWS\system32\c68c.exe
C:\WINDOWS\system32\c86833.exe
C:\WINDOWS\system32\c87aff.exe
C:\WINDOWS\system32\c88d7d.exe
C:\WINDOWS\system32\c8b19f.exe
C:\WINDOWS\system32\c8c47c.exe
C:\WINDOWS\system32\ce573.exe
C:\WINDOWS\system32\cff06.exe
C:\WINDOWS\system32\crugd.cfg
C:\WINDOWS\system32\d244.exe
C:\WINDOWS\system32\d7ee5.exe
C:\WINDOWS\system32\db2d.exe
C:\WINDOWS\system32\ddad83.exe
C:\WINDOWS\system32\ddb7d3.exe
C:\WINDOWS\system32\ddc706.exe
C:\WINDOWS\system32\dddabd.exe
C:\WINDOWS\system32\dde869.exe
C:\WINDOWS\system32\dec7.exe
C:\WINDOWS\system32\df15.exe
C:\WINDOWS\system32\e222.exe
C:\WINDOWS\system32\e649.exe
C:\WINDOWS\system32\e78549.exe
C:\WINDOWS\system32\e79d65.exe
C:\WINDOWS\system32\e7aa65.exe
C:\WINDOWS\system32\e7b5cf.exe
C:\WINDOWS\system32\eaec.exe
C:\WINDOWS\system32\ed8c.exe
C:\WINDOWS\system32\f2fc48.exe
C:\WINDOWS\system32\f3086e.exe
C:\WINDOWS\system32\f31520.exe
C:\WINDOWS\system32\f32f8d.exe
C:\WINDOWS\system32\f33cad.exe
C:\WINDOWS\system32\f443.exe
C:\WINDOWS\system32\f750.exe
C:\WINDOWS\system32\f82b.exe
C:\WINDOWS\system32\fa4e.exe
C:\WINDOWS\system32\fada.exe
C:\WINDOWS\system32\fca6c5.exe
C:\WINDOWS\system32\fcb4fe.exe
C:\WINDOWS\system32\fccdb6.exe
C:\WINDOWS\system32\fcd98d.exe
C:\WINDOWS\system32\fxwmbime.sys
C:\WINDOWS\system32\fzptbjpg.sys
C:\WINDOWS\system32\gajzalit.sys
C:\WINDOWS\system32\gmnait.cfg
C:\WINDOWS\system32\igfxres.dll
C:\WINDOWS\system32\jashbbty.sys
C:\WINDOWS\system32\jyjlt.cfg
C:\WINDOWS\system32\lariytrz.cfg
C:\WINDOWS\system32\njritc.cfg
C:\WINDOWS\system32\oqrthc.cfg
C:\WINDOWS\system32\pmjhbhlp.sys
C:\WINDOWS\system32\pzwmaime.sys
C:\WINDOWS\system32\smmhbsrv.sys
C:\WINDOWS\system32\wmdrtc32.dl_
C:\WINDOWS\system32\wmdrtc32.dll
C:\WINDOWS\system32\xfgnfx.cfg
C:\WINDOWS\system32\xfgnxfn.cfg
C:\WINDOWS\system32\xfztbmsn.sys
C:\WINDOWS\system32\xzcsbhlp.sys
C:\WINDOWS\system32\ysjxbdwd.sys
.
((((((((((((((((((((((((( Files Created from 2008-05-10 to 2008-06-10 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-10 15:01 --------- d-----w C:\Documents and Settings\malk\Application Data\DMCache
2008-06-10 11:58 5,477 ----a-w C:\WINDOWS\system32\drivers\ljoopn.sys
2008-06-10 11:52 98,304 ----a-w C:\WINDOWS\Syn112X.exe
2008-06-10 11:52 9,710,592 ----a-w C:\WINDOWS\RTLCPL.exe
2008-06-10 11:52 86,016 ----a-w C:\WINDOWS\SoundMan.exe
2008-06-10 11:52 69,632 ----a-w C:\WINDOWS\Alcmtr.exe
2008-06-10 11:52 356,352 ----a-w C:\WINDOWS\RtlUpd.exe
2008-06-10 11:52 299,008 ----a-w C:\WINDOWS\uninst.exe
2008-06-10 11:52 2,807,808 ----a-w C:\WINDOWS\alcwzrd.exe
2008-06-10 11:52 2,142,208 ----a-w C:\WINDOWS\MicCal.exe
2008-06-10 11:52 15,473,664 ----a-w C:\WINDOWS\RTHDCPL.exe
2008-06-10 11:17 --------- d-----w C:\Program Files\EsetOnlineScanner
2008-06-10 10:03 15,872 ----a-w C:\WINDOWS\system32\drivers\cdralw.sys
2008-06-09 20:20 --------- d-----w C:\Program Files\ESET
2008-06-09 20:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET
2008-06-09 17:00 --------- d-----w C:\Documents and Settings\malk\Application Data\iolo
2008-06-09 16:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\iolo
2008-06-09 16:57 --------- d-----w C:\Program Files\iolo
2008-06-09 16:57 --------- d-----w C:\Documents and Settings\LocalService\Application Data\iolo
2008-06-09 13:22 --------- d-----w C:\Program Files\Avira
2008-06-09 13:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-06-08 20:32 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-08 20:26 --------- d-----w C:\Program Files\GetData
2008-06-08 13:02 --------- d-----w C:\Program Files\HUMAX ZORRO TOOLBOX V2
2008-06-04 13:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-06-04 09:20 --------- d-----w C:\Program Files\Internet Download Manager
2008-06-01 13:57 --------- d-----w C:\Documents and Settings\malk\Application Data\IDM
2008-06-01 00:50 27,136 ----a-w C:\WINDOWS\AppPatch\AcPlugin.dll
2008-05-31 23:18 --------- d-----w C:\Program Files\Windows Live
2008-05-31 23:17 --------- d-----w C:\Documents and Settings\malk\Application Data\Yahoo!
2008-05-31 23:16 --------- d-----w C:\Program Files\Yahoo!
2008-05-23 04:42 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-23 04:39 --------- d-----w C:\Documents and Settings\malk\Application Data\Media Player Classic
2008-05-23 03:34 --------- d-----w C:\Documents and Settings\malk\Application Data\Thinstall
2008-05-23 03:12 --------- d-----w C:\Program Files\Microsoft.NET
2008-05-23 02:52 10,368 ----a-w C:\WINDOWS\system32\drivers\pfc.sys
2008-05-23 02:52 --------- d-----w C:\Program Files\Common Files\ACD Systems
2008-05-23 02:52 --------- d-----w C:\Program Files\ACD Systems
2008-05-23 02:52 --------- d-----w C:\Documents and Settings\malk\Application Data\ACD Systems
2008-05-23 02:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\ACD Systems
2008-05-23 02:50 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-05-23 02:03 --------- d-----w C:\Program Files\Toshiba
2008-05-23 02:02 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-23 02:01 --------- d-----w C:\Program Files\CONEXANT
2008-05-23 01:51 --------- d-----w C:\Program Files\Realtek
2008-05-23 01:50 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-05-23 01:48 --------- d-----w C:\Program Files\Intel
2008-05-23 01:37 --------- d-----w C:\Program Files\microsoft frontpage
2008-04-14 00:13 40,840 ----a-w C:\WINDOWS\system32\drivers\termdd.sys
2008-04-14 00:13 21,896 ----a-w C:\WINDOWS\system32\drivers\tdtcp.sys
2008-04-14 00:13 139,656 ----a-w C:\WINDOWS\system32\drivers\rdpwd.sys
2008-04-14 00:13 12,040 ----a-w C:\WINDOWS\system32\drivers\tdpipe.sys
2008-04-14 00:11 451,072 ----a-w C:\WINDOWS\AppPatch\aclayers.dll
2008-04-13 19:28 175,744 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys
2008-04-13 19:21 162,816 ----a-w C:\WINDOWS\system32\drivers\netbt.sys
2008-04-13 19:20 91,520 ----a-w C:\WINDOWS\system32\drivers\ndiswan.sys
2008-04-13 19:20 361,344 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-04-13 19:20 182,656 ----a-w C:\WINDOWS\system32\drivers\ndis.sys
2008-04-13 19:19 75,264 ----a-w C:\WINDOWS\system32\drivers\ipsec.sys
2008-04-13 19:19 51,328 ----a-w C:\WINDOWS\system32\drivers\rasl2tp.sys
2008-04-13 19:19 48,384 ----a-w C:\WINDOWS\system32\drivers\raspptp.sys
2008-04-13 19:19 146,048 ----a-w C:\WINDOWS\system32\drivers\portcls.sys
2008-04-13 19:19 138,112 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-04-13 19:18 52,480 ----a-w C:\WINDOWS\system32\drivers\i8042prt.sys
2008-04-13 19:17 83,072 ----a-w C:\WINDOWS\system32\drivers\wdmaud.sys
2008-04-13 19:17 456,576 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
2008-04-13 19:17 105,344 ----a-w C:\WINDOWS\system32\drivers\mup.sys
2008-04-13 19:16 49,536 ----a-w C:\WINDOWS\system32\drivers\classpnp.sys
2008-04-13 19:16 141,056 ----a-w C:\WINDOWS\system32\drivers\ks.sys
2008-04-13 19:15 64,512 ----a-w C:\WINDOWS\system32\drivers\serial.sys
2008-04-13 19:15 60,800 ----a-w C:\WINDOWS\system32\drivers\sysaudio.sys
2008-04-13 19:15 574,976 ----a-w C:\WINDOWS\system32\drivers\ntfs.sys
2008-04-13 19:15 334,848 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-04-13 19:14 63,744 ----a-w C:\WINDOWS\system32\drivers\cdfs.sys
2008-04-13 19:14 143,744 ----a-w C:\WINDOWS\system32\drivers\fastfat.sys
2008-04-13 19:00 30,080 ----a-w C:\WINDOWS\system32\drivers\modem.sys
2008-04-13 19:00 225,664 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-04-13 19:00 19,072 ----a-w C:\WINDOWS\system32\drivers\tdi.sys
2008-04-13 18:57 41,472 ----a-w C:\WINDOWS\system32\drivers\raspppoe.sys
2008-04-13 18:57 40,576 ----a-w C:\WINDOWS\system32\drivers\ndproxy.sys
2008-04-13 18:57 34,560 ----a-w C:\WINDOWS\system32\drivers\wanarp.sys
2008-04-13 18:57 20,864 ----a-w C:\WINDOWS\system32\drivers\ipinip.sys
2008-04-13 18:57 152,832 ----a-w C:\WINDOWS\system32\drivers\ipnat.sys
2008-04-13 18:57 14,336 ----a-w C:\WINDOWS\system32\drivers\asyncmac.sys
2008-04-13 18:57 10,112 ----a-w C:\WINDOWS\system32\drivers\ndistapi.sys
2008-04-13 18:56 88,320 ----a-w C:\WINDOWS\system32\drivers\nwlnkipx.sys
2008-04-13 18:56 69,120 ----a-w C:\WINDOWS\system32\drivers\psched.sys
2008-04-13 18:56 35,072 ----a-w C:\WINDOWS\system32\drivers\msgpc.sys
2008-04-13 18:56 34,688 ----a-w C:\WINDOWS\system32\drivers\netbios.sys
2008-04-13 18:56 30,592 ----a-w C:\WINDOWS\system32\drivers\rndismp.sys
2008-04-13 18:56 30,592 ------w C:\WINDOWS\system32\drivers\rndismpx.sys
2008-04-13 18:56 12,800 ----a-w C:\WINDOWS\system32\drivers\usb8023.sys
2008-04-13 18:56 12,800 ------w C:\WINDOWS\system32\drivers\usb8023x.sys
2008-04-13 18:56 12,288 ----a-w C:\WINDOWS\system32\drivers\tunmp.sys
2008-04-13 18:55 202,624 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-04-13 18:55 14,592 ----a-w C:\WINDOWS\system32\drivers\ndisuio.sys
2008-04-13 18:54 88,192 ----a-w C:\WINDOWS\system32\drivers\irda.sys
2008-04-13 18:54 11,264 ----a-w C:\WINDOWS\system32\drivers\irenum.sys
2008-04-13 18:53 71,552 ----a-w C:\WINDOWS\system32\drivers\bridge.sys
2008-04-13 18:53 40,320 ----a-w C:\WINDOWS\system32\drivers\nmnt.sys
2004-08-08 18:56 520 --sh--w C:\WINDOWS\system32\aoqnabib.sys
2004-08-08 17:58 520 --sh--w C:\WINDOWS\system32\bcsxachu.sys
2004-08-08 19:03 1,560 --sh--w C:\WINDOWS\system32\fassaplo.sys
2004-08-08 17:59 1,560 --sh--w C:\WINDOWS\system32\fstlbsys.sys
2004-08-08 10:27 520 --sh--w C:\WINDOWS\system32\fxcbbime.sys
2004-08-08 18:50 1,560 --sh--w C:\WINDOWS\system32\gpsgajba.sys
2004-08-08 19:04 1,560 --sh--w C:\WINDOWS\system32\newxbttb.sys
2004-08-08 18:53 1,040 --sh--w C:\WINDOWS\system32\rnmxajkl.sys
2004-08-08 18:05 1,040 --sh--w C:\WINDOWS\system32\snfybbyt.sys
2004-08-08 19:02 1,040 --sh--w C:\WINDOWS\system32\spmybapi.sys
2004-08-08 19:04 2,600 --sh--w C:\WINDOWS\system32\spwdbapi.sys
2004-08-08 18:52 2,080 --sh--w C:\WINDOWS\system32\xsdjbbmp.sys
2004-08-08 18:53 1,040 --sh--w C:\WINDOWS\system32\xzfhbjpg.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{13FD5987-65D2-C58D-D87E-987451F12531}]
C:\WINDOWS\system32\swsxachu.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{27AC9076-C898-B098-D098-A18319080972}]
C:\WINDOWS\system32\nhmxbjkl.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{32023698-6984-8541-9654-698745012523}]
C:\WINDOWS\system32\skqncbib.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{33512378-9874-5641-1025-985420368733}]
C:\WINDOWS\system32\oswxcttb.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{37AC9076-C898-B098-D098-A18319080973}]
C:\WINDOWS\system32\nhmxcjkl.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{43512378-9874-5641-1025-985420368734}]
C:\WINDOWS\system32\oswxdttb.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{45694105-5108-9405-3695-954187462154}]
C:\WINDOWS\system32\mpwddapi.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{4A069845-2036-6084-9054-6087502480A4}]
C:\WINDOWS\system32\ozfydbyt.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{4A698102-5904-AFD0-20DF-CD1A65829CA4}]
C:\WINDOWS\system32\zycbdime.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{4FD45A54-9875-698F-E56E-65102358FDF4}]
C:\WINDOWS\system32\apsgdjba.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{55694105-5108-9405-3695-954187462155}]
C:\WINDOWS\system32\mpwdeapi.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{5A069845-2036-6084-9054-6087502480A5}]
C:\WINDOWS\system32\ozfyebyt.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{81954FAC-1023-154F-895A-1458258AD818}]
C:\WINDOWS\system32\ypdjfbmp.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{83BA45AF-FAAA-CDDD-BEEE-BCDE1234AB38}]
C:\WINDOWS\system32\yxfhcjpg.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{9490415F-65F8-B5C5-D8BA-9405FB120549}]
C:\WINDOWS\system32\yzztimsn.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/14/2008 03:12 AM 15360]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [06/01/2008 04:57 PM 920576]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [06/10/2008 02:37 PM 4538368]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SMSystemAnalyzer"="C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe" [05/06/2008 04:36 PM 764776]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [03/13/2008 04:48 PM 1443072]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\CTFMON.EXE" [04/14/2008 03:12 AM 15360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{81954FAC-1023-154F-895A-1458258AD818}"= C:\WINDOWS\system32\ypdjfbmp.dll [ ]
"{27AC9076-C898-B098-D098-A18319080972}"= C:\WINDOWS\system32\nhmxbjkl.dll [ ]
"{4FD45A54-9875-698F-E56E-65102358FDF4}"= C:\WINDOWS\system32\apsgdjba.dll [ ]
"{33512378-9874-5641-1025-985420368733}"= C:\WINDOWS\system32\oswxcttb.dll [ ]
"{4A069845-2036-6084-9054-6087502480A4}"= C:\WINDOWS\system32\ozfydbyt.dll [ ]
"{5A069845-2036-6084-9054-6087502480A5}"= C:\WINDOWS\system32\ozfyebyt.dll [ ]
"{37AC9076-C898-B098-D098-A18319080973}"= C:\WINDOWS\system32\nhmxcjkl.dll [ ]
"{45694105-5108-9405-3695-954187462154}"= C:\WINDOWS\system32\mpwddapi.dll [ ]
"{43512378-9874-5641-1025-985420368734}"= C:\WINDOWS\system32\oswxdttb.dll [ ]
"{9490415F-65F8-B5C5-D8BA-9405FB120549}"= C:\WINDOWS\system32\yzztimsn.dll [ ]
"{32023698-6984-8541-9654-698745012523}"= C:\WINDOWS\system32\skqncbib.dll [ ]
"{83BA45AF-FAAA-CDDD-BEEE-BCDE1234AB38}"= C:\WINDOWS\system32\yxfhcjpg.dll [ ]
"{4A698102-5904-AFD0-20DF-CD1A65829CA4}"= C:\WINDOWS\system32\zycbdime.dll [ ]
"{55694105-5108-9405-3695-954187462155}"= C:\WINDOWS\system32\mpwdeapi.dll [ ]
"{13FD5987-65D2-C58D-D87E-987451F12531}"= C:\WINDOWS\system32\swsxachu.dll [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
"VIDC.ACDV"= ACDV.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Manager.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk
backup=C:\WINDOWS\pss\Bluetooth Manager.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
C:\Program Files\Avira\Avira Premium Security Suite\avgnt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 04/14/2008 03:12 AM 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Device Detector]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 06/01/2008 04:57 PM 920576 C:\Program Files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 08/16/2007 04:19 PM 5728112 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 06/10/2008 02:37 PM 4538368 C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [03/13/2008 04:52 PM]
R2 AVEService;Avira Premium Security Suite MailGuard helper service;"C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe" [02/07/2008 10:06 AM]
R2 ioloFileInfoList;iolo FileInfoList Service;C:\Program Files\iolo\common\lib\ioloServiceManager.exe [05/02/2008 12:31 PM]
R2 ioloSystemService;iolo System Service;C:\Program Files\iolo\common\lib\ioloServiceManager.exe [05/02/2008 12:31 PM]
R2 NdisFileServices32;NdisFileServices32;C:\WINDOWS\system32\drivers\ljoopn.sys [06/10/2008 02:58 PM]
R3 SynMini;USB2.0 1.3M Web Cam;C:\WINDOWS\system32\Drivers\SynMini.sys [04/22/2005 11:34 AM]
R3 SynScan;USB2.0 1.3M Web Cam Still Image;C:\WINDOWS\system32\Drivers\SynScan.sys [04/19/2005 10:16 AM]
S2 AntiVirMailService;Avira Premium Security Suite MailGuard;"C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe" []
S2 antivirwebservice;Avira Premium Security Suite WebGuard;"C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE" []
S2 cdralw;NVIDIA Compatible Windows Miniport Driver;C:\WINDOWS\system32\DRIVERS\nvmini.sys []
S3 eth8023;eth8023;C:\WINDOWS\system32\drivers\eth8023.sys []
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-06-10 18:01:26
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 1
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 06/10/2008 18:05:14 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-10 15:04:56
Pre-Run: 22,907,715,584 bytes free
Post-Run: 22,894,247,936 bytes free
682 --- E O F --- 2008-06-08 12:40:11
