Code:
ComboFix 09-12-30.01 - Deniz Can 31.12.2009 13:16:18.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1254.90.1055.18.511.274 [GMT 2:00]
Running from: c:\documents and settings\Deniz Can\Desktop\ComboFix.exe
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Internet Explorer\iekey.dll
c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013
c:\windows\AppPatch\AcXtrnel.sdb
c:\windows\Fonts\2knxWtVjbWXmUdGG.Ttf
c:\windows\Fonts\6e6EUdxVeWUYJynN.Ttf
c:\windows\Fonts\bKkCsU7Z6YntjH4G.Ttf
c:\windows\Fonts\cD9KArZZUHxCqnyM.Ttf
c:\windows\Fonts\cFDPmh3MDPjcHMPd.Ttf
c:\windows\Fonts\CTwZYd7mY2XCUkn5.Ttf
c:\windows\Fonts\DmYqJAPsv3KjBFCN.ttf
c:\windows\Fonts\du3Q2JXbHYGxcSAe.Ttf
c:\windows\Fonts\eCgMhGRkPUcdutd0.Ttf
c:\windows\Fonts\EEUJgNKN6xmNqKr6.Ttf
c:\windows\Fonts\fKzf9wP6bhq6Bcxa.Ttf
c:\windows\Fonts\G49AhKxDmsj6uxnu.Ttf
c:\windows\Fonts\gTWpW66gR9RSmZrC.Ttf
c:\windows\Fonts\hBRNYhzGWu6vwg6G.Ttf
c:\windows\Fonts\JNwybEjgUVaxBU5d.Ttf
c:\windows\Fonts\KXBqRpa2mrNPeXKb.Ttf
c:\windows\Fonts\MhaUKGazkr3fZZKp.Ttf
c:\windows\Fonts\Nxw6N4rjSsVpMUPe.Ttf
c:\windows\Fonts\PACNkAWTwg4Cyb3e.Ttf
c:\windows\Fonts\pDuuqr4BgFn65AeW.Ttf
c:\windows\Fonts\pKxp3cBbnHVb65ZWUDgRE5.Ttf
c:\windows\Fonts\PrZWDcWgjaE3SQyr.Ttf
c:\windows\Fonts\Qq3qg7RGSp9raxWW.Ttf
c:\windows\Fonts\S8a8cnEuaydPJGg8.Ttf
c:\windows\Fonts\tukVTEVUdJmB1k.Ttf
c:\windows\Fonts\WtEZSTBurjKEKSB9.Ttf
c:\windows\Fonts\YywxhF7TSnkktrJw.Ttf
c:\windows\Fonts\zZ5kDff9es3wZ9YZ.Ttf
c:\windows\system32\Data
c:\windows\system32\ieuinit.inf
c:\windows\system32\scrrntr.dll
c:\windows\unins000.dat
c:\windows\unins000.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NVMINI
-------\Service_nvmini
((((((((((((((((((((((((( Files Created from 2009-11-28 to 2009-12-31 )))))))))))))))))))))))))))))))
.
2009-12-28 21:28 . 2009-12-28 21:29 -------- d-----w- C:\rsit
2009-12-25 17:09 . 2009-12-25 17:09 -------- d-----w- c:\documents and settings\Deniz Can\Local Settings\Application Data\DOSBox
2009-12-25 17:07 . 2009-12-25 17:18 -------- d-----w- c:\program files\DOSBox-0.73
2009-12-25 16:43 . 2009-12-31 10:03 -------- d-----w- C:\TIECD
2009-12-22 20:29 . 2009-12-29 09:13 -------- d-----w- c:\program files\Industry Giant 2
2009-12-21 16:01 . 2009-12-21 16:01 -------- d-----w- c:\program files\Trend Micro
2009-12-18 08:24 . 2009-12-18 08:24 -------- d-----w- c:\temp\FrankProtocol
2009-12-18 08:24 . 2009-12-18 08:24 -------- d-----w- c:\temp\FrankPacManager
2009-12-18 08:24 . 2009-12-18 08:24 -------- d-----w- c:\temp\FrankMedium
2009-12-18 08:24 . 2009-12-18 08:24 -------- d-----w- c:\temp\FrankHandler
2009-12-18 08:24 . 2009-12-18 08:24 -------- d-----w- c:\temp\FrankFormat
2009-12-18 08:24 . 2009-12-18 08:24 -------- d-----w- c:\temp\FrankDevice
2009-12-18 08:24 . 2009-12-18 08:24 -------- d-----w- c:\temp\FrankContents
2009-12-18 08:24 . 2009-12-18 08:24 -------- d-----w- c:\temp\Frank
2009-12-17 09:14 . 2009-04-28 20:20 129520 ------w- c:\windows\system32\pxafs.dll
2009-12-17 09:13 . 2009-12-17 10:15 -------- d-----w- c:\documents and settings\Deniz Can\Application Data\Winamp
2009-12-11 19:30 . 2009-12-17 09:22 -------- d-----w- c:\program files\Winamp
2009-12-05 08:23 . 2009-08-24 23:30 13312 ----a-w- c:\documents and settings\Deniz Can\Application Data\Mozilla\Firefox\Profiles\6bsdy355.default\extensions\twitternotifier@naan.net\components\nsTwitterFoxSign.dll
2009-12-03 19:50 . 2009-12-03 19:50 -------- d-----w- c:\program files\Common Files\Borland Shared
2009-12-03 19:49 . 2009-12-03 19:49 -------- d-----w- c:\temp\Isletme
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-31 07:54 . 2006-04-15 07:52 -------- d-----w- c:\program files\eMule
2009-12-31 07:42 . 2006-05-12 17:25 -------- d-----w- c:\documents and settings\Deniz Can\Application Data\Skype
2009-12-11 19:59 . 2009-10-25 10:18 -------- d-----w- c:\program files\PokerStars.NET
2009-12-11 10:39 . 2009-10-27 17:42 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-12-10 15:28 . 2001-11-22 12:00 419572 ----a-w- c:\windows\system32\perfh01F.dat
2009-12-10 15:28 . 2001-11-22 12:00 76586 ----a-w- c:\windows\system32\perfc01F.dat
2009-11-29 08:35 . 2006-04-15 06:52 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-29 05:46 . 2004-08-03 21:45 661504 ----a-w- c:\windows\system32\wininet.dll
2009-10-22 19:08 . 2006-04-17 14:08 99024 ----a-w- c:\documents and settings\Deniz Can\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-21 06:02 . 2004-08-03 21:45 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 06:02 . 2004-08-03 21:45 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 14:58 . 2004-08-03 20:00 263552 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:52 . 2004-08-03 21:45 267264 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:52 . 2004-08-03 21:45 69632 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:52 . 2004-08-03 21:45 112640 ----a-w- c:\windows\system32\rastls.dll
.
------- Sigcheck -------
[7] 2008-06-20 . B0BEFD78B3816E6A49636A8B67C4F28F . 245760 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\mswsock.dll
[7] 2008-06-20 . F04F500D4217A2C940D91140AC53C717 . 245760 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\mswsock.dll
[-] 2008-06-20 . E4BFA352E2D05B079673BF1FE1FD965D . 245760 . . [5.1.2600.3394] . . c:\windows\system32\mswsock.dll
[7] 2008-06-20 . 8FDC1A5E2813A835ECAEF186AF80C9F5 . 245760 . . [5.1.2600.3394] . . c:\windows\system32\dllcache\mswsock.dll
[7] 2008-06-20 . 7ECF6887F65367DD5CF94C91924588CA . 245760 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\mswsock.dll
[-] 2008-04-14 . C4FDA698CAB8527C1D58D7A437587952 . 245760 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\232cad025a4de3b5651532234015bf6b\mswsock.dll
[7] 2004-08-03 . C1FB7C7331E87A0E5129FCCE0B73167F . 245760 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB951748$\mswsock.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2005-04-08 1953792]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2006-01-18 19477544]
"Rainlendar2"="c:\program files\Rainlendar2\Rainlendar2.exe" [2006-11-26 984064]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 1622016]
"CTSysVol"="c:\program files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-10 90112]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2005-12-20 278528]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"FineReader7NewsReaderPro"="c:\program files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe" [2003-09-11 278528]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-04-22 155648]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-08-09 81920]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-01-31 185872]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-02-06 2021400]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\Start Menu\Programlar\BaŸlang‡\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2006-4-15 49254]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-4-28 113664]
hp psc 1000 series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-4-6 147456]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2003-6-25 614531]
KODAK Software Updater.lnk - c:\program files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe [2003-6-8 16432]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Xfire\\xfire.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Papyrus\\NASCAR Racing 2002 Season\\NR2002.exe"=
"c:\\Program Files\\Chessmaster 8000\\Chessmaster.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [30.06.2006 12:57 664064]
R0 Vax347b;Vax347b;c:\windows\system32\drivers\Vax347b.sys [15.04.2006 14:10 159616]
R0 Vax347s;Vax347s;c:\windows\system32\drivers\Vax347s.sys [15.04.2006 14:10 5248]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [06.02.2009 13:23 106208]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [06.02.2009 13:24 93336]
R1 nltdi;nltdi;c:\windows\system32\drivers\nltdi.sys [14.06.2006 21:44 93824]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [06.02.2009 13:23 727720]
S2 FILESpy;FILESpy;\??\c:\program files\Softwin\BitDefender9\filespy.sys --> c:\program files\Softwin\BitDefender9\filespy.sys [?]
S3 ICDUSB2;Sony IC Recorder (P);c:\windows\system32\drivers\IcdUsb2.sys [03.01.2008 16:09 39048]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
S4 Rdpidirvw;Rdpidirvw;c:\windows\system32\drivers\rawwan.sys [22.11.2001 14:00 34432]
.
Contents of the 'Scheduled Tasks' folder
2007-11-28 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1200 series5E771253C1676EBED677BF361FDFC537825E15B8188319073.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 21:52]
2009-12-31 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-14 19:18]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = localhost
uInternet Settings,ProxyServer = 217.195.246.83:8080
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
TCP: {37D17006-8E1A-4418-AF41-AD76C2FA64C7} = 195.175.39.40,195.175.39.39
FF - ProfilePath - c:\documents and settings\Deniz Can\Application Data\Mozilla\Firefox\Profiles\6bsdy355.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - component: c:\documents and settings\Deniz Can\Application Data\Mozilla\Firefox\Profiles\6bsdy355.default\extensions\twitternotifier@naan.net\components\nsTwitterFoxSign.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdjvu.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NpFv41629.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-BDSwitchAgent - c:\progra~1\softwin\bitdef~1\bdswitch.exe
HKLM-Run-mirc - c:\windows\WINCRA\mirc.exe
HKLM-Run-ISUSPM Startup - c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe
ShellExecuteHooks-{1ECE2FCB-C1BB-4706-920C-F4C1076FD155} - c:\windows\system32\kT2NuqZeGma.dll
ShellExecuteHooks-{7A93621D-BFFE-4EB1-AAE1-CD487F429840} - c:\windows\system32\PkVyCX5kHnftC7BXjt.dll
ShellExecuteHooks-{CCCA2FB9-2D5D-4481-8BFE-1CDDC458A3F4} - c:\windows\system32\CCCA2FB9.dll
ShellExecuteHooks-{EF6EF2D9-CDC7-481D-B17C-DA8DBA33BB01} - c:\windows\system32\kW5xUYZjcSnWs.dll
ShellExecuteHooks-{6B74576A-BB20-47B3-AE0A-046B062897D0} - c:\windows\system32\ACg9ycsarj8y.dll
ShellExecuteHooks-{19250D1E-B733-4F49-BC56-44EFCF3BF650} - c:\windows\system32\m37tEtTX7Ye5c.dll
ShellExecuteHooks-{A35BF249-2B40-4E4A-97B5-86DC8B358887} - c:\windows\system32\j8EG7scz8.dll
AddRemove-Flatcast_is1 - c:\windows\unins000.exe
AddRemove-IL Download Manager - c:\program files\Image-Line\Downloader\uninstall.exe
AddRemove-MyProduct - c:\program files\Ubisoft\Crytek\Far Cry\Bin32\Uninstal.exe
AddRemove-ShockwaveFlash - c:\windows\system32\Macromed\Flash\UninstFl.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-31 13:31
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe >>UNKNOWN [0x82F96688]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> 0x82f96688
\Driver\ACPI -> ACPI.sys @ 0xf8563cb8
\Driver\atapi -> 0x82d0e748
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0084
ParseProcedure -> ntoskrnl.exe @ 0x8056f07e
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0084
ParseProcedure -> ntoskrnl.exe @ 0x8056f07e SendCompleteHandler -> NDIS.sys @ 0xf83ebaf9
PacketIndicateHandler -> NDIS.sys @ 0xf83f6b21
SendHandler -> NDIS.sys @ 0xf83eb938
Warning: possible MBR rootkit infection !
user & kernel MBR OK
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1614895754-448539723-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:d6,1c,17,c1,3a,ee,f8,7f,36,c2,37,20,cd,c0,87,30,05,36,83,9e,7c,
3d,8c,35,8c,89,75,43,aa,2a,ca,2b,ae,1c,b8,51,88,35,df,6d,6a,15,d7,07,61,8a,\
"rkeysecu"=hex:11,4a,21,88,3e,48,d9,8c,f2,33,47,f6,d6,5d,83,4e
[HKEY_LOCAL_MACHINE\System\MountedDevices]
@Denied: (Read) (Administrators)
"\\??\\Volume{03c46290-cbfc-11da-a90f-806d6172696f}"=hex:5c,00,3f,00,3f,00,5c,
00,46,00,44,00,43,00,23,00,47,00,45,00,4e,00,45,00,52,00,49,00,43,00,5f,00,\
"\\??\\Volume{03c46291-cbfc-11da-a90f-806d6172696f}"=hex:5c,00,3f,00,3f,00,5c,
00,49,00,44,00,45,00,23,00,43,00,64,00,52,00,6f,00,6d,00,48,00,4c,00,2d,00,\
"\\??\\Volume{03c46292-cbfc-11da-a90f-806d6172696f}"=hex:5c,00,3f,00,3f,00,5c,
00,49,00,44,00,45,00,23,00,43,00,64,00,52,00,6f,00,6d,00,48,00,4c,00,2d,00,\
"\\??\\Volume{03c46294-cbfc-11da-a90f-806d6172696f}"=hex:e3,06,e3,06,00,48,e6,
3f,10,00,00,00
"\\DosDevices\\D:"=hex:e3,06,e3,06,00,48,e6,3f,10,00,00,00
"\\DosDevices\\A:"=hex:5c,00,3f,00,3f,00,5c,00,46,00,44,00,43,00,23,00,47,00,
45,00,4e,00,45,00,52,00,49,00,43,00,5f,00,46,00,4c,00,4f,00,50,00,50,00,59,\
"\\DosDevices\\E:"=hex:5c,00,3f,00,3f,00,5c,00,49,00,44,00,45,00,23,00,43,00,
64,00,52,00,6f,00,6d,00,48,00,4c,00,2d,00,44,00,54,00,2d,00,53,00,54,00,5f,\
"\\DosDevices\\F:"=hex:5c,00,3f,00,3f,00,5c,00,49,00,44,00,45,00,23,00,43,00,
64,00,52,00,6f,00,6d,00,48,00,4c,00,2d,00,44,00,54,00,2d,00,53,00,54,00,5f,\
"\\??\\Volume{03c46296-cbfc-11da-a90f-806d6172696f}"=hex:e3,06,e3,06,00,7e,00,
00,00,00,00,00
"\\DosDevices\\C:"=hex:e3,06,e3,06,00,7e,00,00,00,00,00,00
"\\??\\Volume{2c5fd2fc-cc79-11da-917c-0000e84b3687}"=hex:5c,00,3f,00,3f,00,5c,
00,53,00,43,00,53,00,49,00,23,00,43,00,64,00,52,00,6f,00,6d,00,26,00,56,00,\
"\\DosDevices\\G:"=hex:5c,00,3f,00,3f,00,5c,00,53,00,43,00,53,00,49,00,23,00,
43,00,64,00,52,00,6f,00,6d,00,26,00,56,00,65,00,6e,00,5f,00,53,00,43,00,53,\
"\\??\\Volume{2c5fd2fd-cc79-11da-917c-0000e84b3687}"=hex:5c,00,3f,00,3f,00,5c,
00,53,00,54,00,4f,00,52,00,41,00,47,00,45,00,23,00,52,00,65,00,6d,00,6f,00,\
"\\DosDevices\\H:"=hex:5c,00,3f,00,3f,00,5c,00,53,00,54,00,4f,00,52,00,41,00,
47,00,45,00,23,00,52,00,65,00,6d,00,6f,00,76,00,61,00,62,00,6c,00,65,00,4d,\
"\\??\\Volume{2c5fd301-cc79-11da-917c-0000e84b3687}"=hex:5c,00,3f,00,3f,00,5c,
00,53,00,54,00,4f,00,52,00,41,00,47,00,45,00,23,00,52,00,65,00,6d,00,6f,00,\
"\\DosDevices\\I:"=hex:d9,fe,52,a5,00,00,7e,00,00,00,00,00
"\\??\\Volume{fe8a6ee8-292e-11db-9251-0000e84b3687}"=hex:5c,00,3f,00,3f,00,5c,
00,53,00,54,00,4f,00,52,00,41,00,47,00,45,00,23,00,52,00,65,00,6d,00,6f,00,\
"\\??\\Volume{1cefad0a-72ef-11db-92b6-0000e84b3687}"=hex:5c,00,3f,00,3f,00,5c,
00,53,00,54,00,4f,00,52,00,41,00,47,00,45,00,23,00,52,00,65,00,6d,00,6f,00,\
"\\??\\Volume{1cefad0b-72ef-11db-92b6-0000e84b3687}"=hex:5c,00,3f,00,3f,00,5c,
00,53,00,54,00,4f,00,52,00,41,00,47,00,45,00,23,00,52,00,65,00,6d,00,6f,00,\
"\\DosDevices\\J:"=hex:5c,00,3f,00,3f,00,5c,00,53,00,54,00,4f,00,52,00,41,00,
47,00,45,00,23,00,52,00,65,00,6d,00,6f,00,76,00,61,00,62,00,6c,00,65,00,4d,\
"\\??\\Volume{7a240d66-fd72-11db-9379-0000e84b3687}"=hex:5c,00,3f,00,3f,00,5c,
00,53,00,54,00,4f,00,52,00,41,00,47,00,45,00,23,00,52,00,65,00,6d,00,6f,00,\
"\\??\\Volume{3e3cd785-10d1-11dc-9391-0000e84b3687}"=hex:5c,00,3f,00,3f,00,5c,
00,53,00,54,00,4f,00,52,00,41,00,47,00,45,00,23,00,52,00,65,00,6d,00,6f,00,\
"\\??\\Volume{aca44564-18af-11dc-9393-0000e84b3687}"=hex:5c,00,3f,00,3f,00,5c,
00,53,00,54,00,4f,00,52,00,41,00,47,00,45,00,23,00,52,00,65,00,6d,00,6f,00,\
"\\??\\Volume{b6683514-b491-11dc-9432-0000e84b3687}"=hex:46,78,4a,30,00,7e,00,
00,00,00,00,00
"\\??\\Volume{3da0b67b-f289-11dc-9482-0000e84b3687}"=hex:5c,00,3f,00,3f,00,5c,
00,53,00,54,00,4f,00,52,00,41,00,47,00,45,00,23,00,52,00,65,00,6d,00,6f,00,\
"\\??\\Volume{4463c76c-03f4-11dd-9493-0000e84b3687}"=hex:5c,00,3f,00,3f,00,5c,
00,53,00,54,00,4f,00,52,00,41,00,47,00,45,00,23,00,52,00,65,00,6d,00,6f,00,\
"\\??\\Volume{61a5c57e-370a-11dd-94d1-0000e84b3687}"=hex:5c,00,3f,00,3f,00,5c,
00,53,00,54,00,4f,00,52,00,41,00,47,00,45,00,23,00,52,00,65,00,6d,00,6f,00,\
"\\??\\Volume{f9f37baa-3d48-11dd-94d9-0000e84b3687}"=hex:5c,00,3f,00,3f,00,5c,
00,53,00,54,00,4f,00,52,00,41,00,47,00,45,00,23,00,52,00,65,00,6d,00,6f,00,\
"\\??\\Volume{9d2560ac-831a-11dd-951b-0000e84b3687}"=hex:46,c6,6a,5b,00,7e,00,
00,00,00,00,00
"\\??\\Volume{c56024ec-e3a8-11dd-95f0-0000e84b3687}"=hex:5c,00,3f,00,3f,00,5c,
00,53,00,54,00,4f,00,52,00,41,00,47,00,45,00,23,00,52,00,65,00,6d,00,6f,00,\
"\\??\\Volume{08ba475c-1132-11de-9648-0000e84b3687}"=hex:d9,fe,52,a5,00,00,7e,
00,00,00,00,00
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(2368)
c:\docume~1\DENIZC~1\LOCALS~1\TempIadHide3.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\CTsvcCDA.exe
c:\windows\system32\drivers\KodakCCS.exe
c:\program files\NetLimiter 2 Pro\nlsvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\ScsiAccess.EXE
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\MsPMSPSv.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\SONY\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
c:\program files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
c:\program files\Java\jre1.6.0_05\bin\jucheck.exe
c:\windows\system32\DllHost.exe
c:\windows\system32\MATLAB~1.SCR
.
**************************************************************************
.
Completion time: 2009-12-31 13:50:37 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-31 11:50
Pre-Run: 14.648.020.992 bayt boş
Post-Run: 14.832.390.144 bayt boş
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - F08B234357EA6D70077187B510EC672E
Mit Zitat antworten
Zitat von Jintan
