اخي العزيز ..هذا تقرير الهايجاك بعد ان استعملت الادوات ...وبالنسبة لبرنامج انتي فيروس..ذكرت اكثر من مرة انني كلما اريد ان انزل اي انتي فايروس تاتي الشاشة الزرقاء على الفور ..حاولت ان اعمل فورمات ولكن ايضا نفس الشيء:er::er:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:04:05, on 7/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\azzam.exe
C:\Program Files\On Screen Display\Hotkey.exe
C:\Program Files\USB Disk Security\USBGuard.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\PCCheckUp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Zeinab2810\Desktop\all files\Zyzoom_HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\azzam.exe" /minimized
O4 - HKLM\..\Run: [KeybdUtility] "C:\Program Files\On Screen Display\Hotkey.exe"
O4 - HKLM\..\Run: [USB Antivirus] C:\Program Files\USB Disk Security\USBGuard.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PC-Checkup] "C:\Program Files\PCCheckUp.exe" -mini
O4 - HKLM\..\Run: [Vistadrv] C:\Program Files\VistaDrives\vsdrv.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Startup: StartupFaster
O4 - Global Startup: StartupFaster
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{B9834850-497A-40BA-A797-D47F0845FD9F}: NameServer = 172.10.0.1 91.142.48.48
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
--
End of file - 4359 bytes
وهذا تقرير اداة الكومبو
ComboFix 08-07-12.2 - Zeinab2810 2008-07-13 14:44:12.4 - NTFSx86 MINIMAL
Running from: C:\Documents and Settings\Zeinab2810\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system\oeminfo.ini
C:\WINDOWS\system32\oeminfo.ini
C:\WINDOWS\system32\vb6lib.dll
.
((((((((((((((((((((((((( Files Created from 2008-06-13 to 2008-07-13 )))))))))))))))))))))))))))))))
.
2008-07-13 11:20 . 2008-07-13 11:20 <DIR> d-------- C:\Program Files\VistaDrives
2008-07-11 15:53 . 2008-07-12 12:37 369 --a------ C:\WINDOWS\system\Cmicnfg.ini
2008-07-09 17:22 . 2008-07-09 17:23 <DIR> d-------- C:\Zyzoom_RFA_Platinum
2008-07-09 17:22 . 2008-07-09 17:22 <DIR> d-------- C:\silver
2008-07-04 16:38 . 2008-07-04 16:38 <DIR> d-------- C:\WINDOWS\l2schemas
2008-07-04 12:47 . 2007-02-28 12:38 2,057,600 --a------ C:\WINDOWS\system32\drivers\ntkrnlpa.exe
2008-07-01 15:44 . 2004-08-04 05:26 257,024 --a--c--- C:\WINDOWS\system32\dllcache\infocomm.dll
2008-07-01 15:43 . 2004-08-04 05:26 562,176 --a--c--- C:\WINDOWS\system32\dllcache\fxsst.dll
2008-07-01 15:42 . 2004-08-04 05:26 2,134,528 --a--c--- C:\WINDOWS\system32\dllcache\smtpsnap.dll
2008-07-01 15:40 . 2008-07-01 15:40 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-07-01 15:39 . 2001-08-23 09:30 16,384 --a--c--- C:\WINDOWS\system32\dllcache\isignup.exe
2008-07-01 15:39 . 2008-07-10 21:27 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-07-01 15:39 . 2008-07-10 21:27 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-07-01 15:39 . 2008-07-10 21:27 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-07-01 15:39 . 2008-07-10 21:27 749 -rah----- C:\WINDOWS\system32\nwc.cpl.manifest
2008-07-01 15:39 . 2008-07-10 21:27 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-07-01 15:38 . 2004-08-04 05:26 214,528 --a--c--- C:\WINDOWS\system32\dllcache\icwconn1.exe
2008-07-01 15:38 . 2004-08-04 05:26 86,016 --a--c--- C:\WINDOWS\system32\dllcache\icwconn2.exe
2008-07-01 15:38 . 2004-08-04 05:26 32,768 --a--c--- C:\WINDOWS\system32\dllcache\icwdl.dll
2008-07-01 15:38 . 2004-08-04 05:26 20,480 --a--c--- C:\WINDOWS\system32\dllcache\inetwiz.exe
2008-07-01 15:36 . 2001-08-23 09:30 169,984 --a--c--- C:\WINDOWS\system32\dllcache\iisui.dll
2008-07-01 15:36 . 2001-08-23 09:30 60,928 --a--c--- C:\WINDOWS\system32\dllcache\iisclex4.dll
2008-07-01 15:36 . 2001-08-23 09:30 19,968 --a------ C:\WINDOWS\system32\inetsloc.dll
2008-07-01 15:36 . 2001-08-23 09:30 19,968 --a--c--- C:\WINDOWS\system32\dllcache\inetsloc.dll
2008-07-01 15:36 . 2001-08-23 09:30 7,168 --a------ C:\WINDOWS\system32\wamregps.dll
2008-07-01 15:36 . 2001-08-23 09:30 7,168 --a--c--- C:\WINDOWS\system32\dllcache\wamregps.dll
2008-07-01 15:36 . 2001-08-23 09:30 3,584 --a------ C:\WINDOWS\system32\iismui.dll
2008-07-01 15:36 . 2001-08-23 09:30 3,584 --a--c--- C:\WINDOWS\system32\dllcache\iismui.dll
2008-07-01 15:33 . 2004-08-04 05:26 133,632 --a------ C:\WINDOWS\system32\iisRtl.dll
2008-07-01 15:33 . 2004-08-04 05:26 133,632 --a--c--- C:\WINDOWS\system32\dllcache\iisrtl.dll
2008-07-01 15:24 . 2004-08-04 06:27 1,086,058 -ra------ C:\WINDOWS\SET99.tmp
2008-07-01 15:24 . 2004-08-04 06:33 1,042,903 -ra------ C:\WINDOWS\SET96.tmp
2008-07-01 15:24 . 2004-08-04 06:28 502,724 --a--c--- C:\WINDOWS\system32\dllcache\NT5INF.CAT
2008-07-01 15:24 . 2004-08-04 06:28 13,753 -ra------ C:\WINDOWS\SETA5.tmp
2008-06-28 13:57 . 2008-06-30 15:15 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2008-06-28 13:06 . 2008-06-28 13:15 <DIR> d-------- C:\Program Files\RCrawler
2008-06-27 23:58 . 2008-06-28 00:02 <DIR> d-------- C:\Program Files\Microsoft Bootvis
2008-06-27 23:37 . 2008-06-27 23:37 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-06-27 23:28 . 2008-06-27 23:28 <DIR> d-------- C:\Program Files\Debugging Tools for Windows
2008-06-27 13:00 . 2008-06-27 13:01 <DIR> d-------- C:\Documents and Settings\Zeinab2810\Application Data\LogoMaker
2008-06-26 23:45 . 2008-06-26 23:45 <DIR> d--hs---- C:\found.001
2008-06-26 13:40 . 2008-07-13 14:21 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2008-06-25 16:24 . 2004-01-11 01:17 45,568 --a------ C:\WINDOWS\system32\YM11AUTH.DLL
2008-06-25 11:59 . 2008-07-01 01:33 <DIR> d-------- C:\Program Files\USB Disk Security
2008-06-24 19:51 . 2004-05-13 14:15 89,600 --a------ C:\WINDOWS\system32\MSCAL.OCX
2008-06-24 01:14 . 2004-01-29 14:32 132,608 --a------ C:\WINDOWS\system32\TLBINF32.DLL
2008-06-23 20:51 . 2008-06-23 20:51 <DIR> d-------- C:\Documents and Settings\Jnoubi2210\Application Data\URSoft
2008-06-23 20:51 . 2008-06-23 20:51 <DIR> d-------- C:\Documents and Settings\Jnoubi2210\Application Data\Grisoft
2008-06-23 15:22 . 2003-09-23 09:30 647,872 --a--c--- C:\WINDOWS\system32\MSCOMCT2.OCX
2008-06-23 15:20 . 2003-09-23 09:30 109,248 --a--c--- C:\WINDOWS\system32\MSWINSCK.OCX
2008-06-23 14:49 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-06-23 14:49 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-06-23 14:49 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-06-23 14:49 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-06-23 14:49 . 2008-06-15 15:28 81,920 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-06-23 14:49 . 2008-05-23 18:21 81,920 --a------ C:\WINDOWS\system32\404Fix.exe
2008-06-23 14:49 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-06-23 14:49 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-06-23 14:49 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-06-22 12:03 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-06-22 12:03 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-06-21 15:34 . 2008-07-12 18:38 534,990,848 --a------ C:\WINDOWS\MEMORY.DMP
2008-06-21 11:55 . 2006-07-22 23:49 5,376 --a------ C:\WINDOWS\system32\antiwpa.dll
2008-06-21 11:54 . 2004-08-04 05:26 96,768 --a------ C:\WINDOWS\system32\dpcdll.dll.wga
2008-06-21 11:54 . 2004-08-04 05:26 24,064 --a------ C:\WINDOWS\system32\pidgen.dll.wga
2008-06-21 11:23 . 2004-08-04 05:26 358,912 --a--c--- C:\WINDOWS\system32\dllcache\wmic.exe
2008-06-21 11:23 . 2004-08-04 05:26 92,672 --a--c--- C:\WINDOWS\system32\dllcache\policman.dll
2008-06-21 11:15 . 2004-08-04 06:27 1,086,058 -ra------ C:\WINDOWS\SET3A.tmp
2008-06-21 11:15 . 2004-08-04 06:33 1,042,903 -ra------ C:\WINDOWS\SET37.tmp
2008-06-21 11:15 . 2004-08-04 06:28 13,753 -ra------ C:\WINDOWS\SET49.tmp
2008-06-20 23:32 . 2008-07-01 19:51 <DIR> d-------- C:\WINDOWS\ehome
2008-06-20 22:20 . 2004-08-04 06:27 1,086,058 -ra------ C:\WINDOWS\SET39.tmp
2008-06-20 22:20 . 2004-08-04 06:33 1,042,903 -ra------ C:\WINDOWS\SET36.tmp
2008-06-20 22:20 . 2004-08-04 06:28 13,753 -ra------ C:\WINDOWS\SET45.tmp
2008-06-20 19:14 . 2004-08-04 06:27 1,086,058 -ra------ C:\WINDOWS\SET38.tmp
2008-06-20 19:14 . 2004-08-04 06:33 1,042,903 -ra------ C:\WINDOWS\SET35.tmp
2008-06-20 19:14 . 2004-08-04 06:28 13,753 -ra------ C:\WINDOWS\SET44.tmp
2008-06-20 18:04 . 2004-08-04 16:30 1,086,058 -ra------ C:\WINDOWS\SET34.tmp
2008-06-20 18:04 . 2004-08-04 16:30 1,042,903 -ra------ C:\WINDOWS\SET31.tmp
2008-06-20 18:04 . 2004-08-04 16:30 13,753 -ra------ C:\WINDOWS\SET40.tmp
2008-06-20 18:04 . 2003-12-19 18:52 7,710 -ra------ C:\WINDOWS\SET55.tmp
2008-06-20 17:26 . 2004-08-04 16:30 1,086,058 -ra------ C:\WINDOWS\SETBA.tmp
2008-06-20 17:26 . 2004-08-04 16:30 1,042,903 -ra------ C:\WINDOWS\SETB7.tmp
2008-06-20 17:26 . 2004-08-04 16:30 13,753 -ra------ C:\WINDOWS\SETC6.tmp
2008-06-20 17:26 . 2003-12-19 18:52 7,710 -ra------ C:\WINDOWS\SETDB.tmp
2008-06-20 17:04 . 2008-06-20 17:04 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\CyberScrub
2008-06-20 17:03 . 2008-06-20 17:03 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\cleaner
2008-06-20 14:05 . 2008-06-20 14:05 <DIR> d-------- C:\Documents and Settings\Jnoubi2210
2008-06-19 17:06 . 2008-06-19 17:06 <DIR> d-------- C:\Documents and Settings\Zeinab2810\Application Data\URSoft
2008-06-17 21:00 . 2008-06-17 21:00 <DIR> d-------- C:\Documents and Settings\Zeinab2810\Application Data\Mikrotik
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-13 09:47 --------- d-----w C:\Documents and Settings\Zeinab2810\Application Data\cleaner
2008-07-12 08:18 75,518 ----a-w C:\Program Files\PC-Checkup.log
2008-07-12 08:18 24,010 ----a-w C:\Program Files\PC-Checkup.lst
2008-07-12 08:18 --------- d-----w C:\Program Files\Backup
2008-07-11 11:21 --------- d-----w C:\Program Files\lg_swupdate
2008-07-01 08:10 --------- d-----w C:\Documents and Settings\Zeinab2810\Application Data\Thinstall
2008-06-28 15:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-06-25 08:02 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-24 16:47 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-13 00:09 --------- d-----w C:\Documents and Settings\Zeinab2810\Application Data\Skype
2008-06-10 22:18 --------- d-----w C:\Documents and Settings\Zeinab2810\Application Data\skypePM
2008-06-09 11:09 --------- d-----w C:\Documents and Settings\Zeinab2810\Application Data\Zyzoom_Autorun_Viruses_cleaner
2008-06-02 09:38 456 ----a-w C:\Program Files\note-sv.html
2008-06-02 09:38 18,304 ----a-w C:\Program Files\irunin.ini
2008-06-02 09:37 8,134 ----a-w C:\Program Files\irunin.bmp
2008-06-02 09:37 737,280 -c--a-w C:\WINDOWS\iun6002.exe
2008-06-02 09:37 7,351 ----a-w C:\Program Files\irunin.dat
2008-06-02 09:37 15,938 ----a-w C:\Program Files\irunin.lng
2008-05-29 11:33 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-05-29 11:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-05-29 11:32 --------- d-----w C:\Program Files\Messenger Plus! Live(2)
2008-05-22 11:31 --------- d-----w C:\Documents and Settings\Zeinab2810\Application Data\MyLogoMaker
2008-05-22 11:28 --------- d-----w C:\Program Files\MySoftware
2008-05-21 13:20 5,009,900 -c--a-w C:\WINDOWS\REGBK00.ZIP
2008-05-17 09:48 --------- d-----w C:\Program Files\Skype
2008-05-17 09:48 --------- d-----w C:\Program Files\Common Files\Skype
2008-05-17 09:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-05-16 07:58 --------- d-----w C:\Program Files\SpiritPyre Extensions
2008-05-15 07:32 --------- d-----w C:\Program Files\Abadisoft
2008-04-18 09:00 64,342 -c--a-w C:\WINDOWS\BricoPackUninst.cmd
2008-04-18 09:00 6,120 -c--a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2007-06-05 07:24 3,949,568 -c--a-w C:\Program Files\PCCheckUp.exe
2007-02-25 05:09 118,784 -c--a-w C:\Program Files\JkDefrag.dll
2004-01-26 13:36 110,592 -c--a-w C:\Program Files\NTAMK.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-08-16 17:49 5728112]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:26 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\azzam.exe" [2008-04-04 16:52 6731312]
"KeybdUtility"="C:\Program Files\On Screen Display\Hotkey.exe" [2005-07-26 10:48 81920]
"USB Antivirus"="C:\Program Files\USB Disk Security\USBGuard.exe" [2008-05-29 09:43 798720]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-29 05:32 98394]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-29 05:31 688218]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-07 16:19 185896]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 16:30 208952]
"IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 16:30 44032]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 03:01 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 03:02 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 03:02 455168]
"PC-Checkup"="C:\Program Files\PCCheckUp.exe" [2007-06-05 11:54 3949568]
"Vistadrv"="C:\Program Files\VistaDrives\vsdrv.exe" [2006-07-30 03:37 121089]
"AGRSMMSG"="AGRSMMSG.exe" [2004-11-09 12:49 88358 C:\WINDOWS\AGRSMMSG.exe]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoDispAppearancePage"= 0 (0x0)
"NoDispScrSavPage"= 0 (0x0)
"NoDispSettingsPage"= 0 (0x0)
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
"NoFolderOptions"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoClose"= 0 (0x0)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{26F5978F-6493-4ee3-B114-C0C3ACCF9D4D}"= "C:\WINDOWS\system32\bmpsap.dll" [2006-06-01 19:24 114688]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli scecli scecli
[HKLM\~\startupfolder\C:^Documents and Settings^Zeinab2810^Start Menu^Programs^Startup^RocketDock.lnk]
backup=C:\WINDOWS\pss\RocketDock.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k [X]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartupFaster
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a--c--- 2004-12-07 22:40 344064 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\batterymiser]
--a--c--- 2006-06-01 19:24 335872 C:\Program Files\Battery miser\batterymiser.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 05:26 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a--c--- 2004-08-04 16:30 208952 C:\WINDOWS\ime\imjp8_1\imjpmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPO3]
--a--c--- 2005-06-22 13:30 1028096 C:\Program Files\LG Software\IP Operator 2005\IP Operator 2005.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LG Intelligent Update]
--a--c--- 2008-04-07 08:06 102400 C:\Program Files\lg_swupdate\autoupdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC-Checkup]
--a--c--- 2007-06-05 11:54 3949568 C:\Program Files\PCCheckUp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a--c--- 2004-10-29 05:31 688218 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
--a--c--- 2004-10-29 05:32 98394 C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a--c--- 2008-04-07 16:19 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tracks Eraser Pro]
--a--c--- 2008-03-18 20:43 1363816 C:\Program Files\Acesoft\Tracks Eraser Pro\te.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a--c--- 2007-04-25 20:14 35328 C:\Program Files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
-ra--c--- 2004-11-09 12:49 88358 C:\WINDOWS\AGRSMMSG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\system32\\sessmgr.exe"=
R3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys [2005-05-12 14:39]
R3 tifm;tifm;C:\WINDOWS\system32\drivers\tifm.sys [2004-05-21 23:48]
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-Cmaudio - cmicnfg.cpl
HKLM-RunServices-Driver32 - (no file)
HKLM-RunServices-raVe - (no file)
MSConfigStartUp-Cmaudio - cmicnfg.cpl
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-07-13 14:53:35
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-07-13 15:02:09 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-13 10:31:43
Pre-Run: 32,622,518,272 bytes free
Post-Run: 31,952,904,192 bytes free
250 --- E O F --- 2008-07-13 06:14:55
