Помощ при откриване и премахване на вируси, троянски коне и др., част 2

1 февруари 200917 г.

Благодарение на B-Boy[styLe], можеш да си я изтеглиш от тук:

http://4storing.com/i4sq3/07718d2217f2cb69...79514059dc.html

Първо направи това с ComboFIx, а след това с тази програма.

1 февруари 200917 г.

Благодарение на B-Boy[styLe], можеш да си я изтеглиш от тук:
http://4storing.com/i4sq3/07718d2217f2cb69...79514059dc.html

Първо направи това с ComboFIx, а след това с тази програма.

Благодаря и на B-Boy[styLe] ... окси свалям безплатната и запо4вам под ред

ComboFix 09-01-31.01 - Ronksi 2009-02-01 14:56:01.3 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.1023.567 [GMT -8:00]

Running from: c:\documents and settings\Ronksi\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Ronksi\Desktop\CFScript.txt

AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated)

* Created a new restore point

* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

c:\windows\system32\msvcrt2.dll

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system\smsc32.exe

c:\windows\system32\drivers\sysdrv32.sys

c:\windows\system32\msvcrt2.dll

c:\windows\system32\x.exe

c:\windows\temp

c:\windows\temp\35.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_SYSDRV32

-------\Service_sysdrv32

((((((((((((((((((((((((( Files Created from 2009-01-01 to 2009-02-01 )))))))))))))))))))))))))))))))

.

2009-02-01 13:20 . 2009-02-01 13:20 <DIR> d-------- c:\documents and settings\Ronksi\dwhelper

2009-01-28 20:02 . 2009-01-28 20:02 <DIR> d-------- c:\program files\Sagasoft

2009-01-27 18:26 . 2009-01-27 20:03 <DIR> d-------- c:\program files\MSN Messenger

2009-01-27 17:17 . 2009-01-27 17:30 <DIR> d-------- c:\documents and settings\Ronksi\Contacts

2009-01-27 16:31 . 2009-01-27 16:32 <DIR> d-------- c:\documents and settings\Ronksi\Application Data\MSNInstaller

2009-01-27 15:52 . 2009-01-27 15:52 <DIR> d-------- c:\program files\Common Files\Windows Live

2009-01-27 13:35 . 2009-01-27 13:35 <DIR> d--hs---- C:\found.000

2009-01-27 13:30 . 2009-01-27 13:30 <DIR> d-------- c:\program files\Adobe Media Player

2009-01-22 15:37 . 2009-02-01 12:54 <DIR> d-------- c:\documents and settings\multiskype.RONKSI\Application Data\Skype

2009-01-22 15:37 . 2009-01-27 13:32 <DIR> d-------- c:\documents and settings\multiskype.RONKSI

2009-01-22 12:43 . 2008-10-16 12:38 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll

2009-01-22 12:43 . 2008-10-16 12:38 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll

2009-01-22 12:43 . 2008-10-16 12:38 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll

2009-01-22 12:43 . 2008-10-16 12:38 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll

2009-01-22 12:43 . 2008-10-16 12:38 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll

2009-01-22 12:43 . 2008-10-16 05:11 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe

2009-01-22 12:42 . 2008-10-16 12:38 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll

2009-01-22 12:42 . 2007-04-17 01:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat

2009-01-22 12:42 . 2007-03-07 21:10 991,232 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui

2009-01-22 12:25 . 2009-01-22 12:24 410,984 --a------ c:\windows\system32\deploytk.dll

2009-01-17 17:41 . 2009-01-17 17:41 <DIR> d-------- c:\program files\Webteh

2009-01-17 17:41 . 2009-01-17 17:43 <DIR> d-------- c:\program files\BS.Player ControlBar

2009-01-17 17:41 . 2009-01-17 17:41 <DIR> d-------- c:\documents and settings\Ronksi\Application Data\BSplayer Pro

2009-01-17 17:41 . 2009-01-17 20:23 <DIR> d-------- c:\documents and settings\Ronksi\Application Data\BSplayer

2009-01-16 11:41 . 2009-01-16 11:41 323,584 --a------ c:\windows\system32\AUDIOGENIE2.DLL

2009-01-16 11:40 . 2009-01-16 11:40 <DIR> d-------- c:\windows\Freecorder Toolbar

2009-01-16 11:39 . 2009-01-16 11:39 <DIR> d-------- c:\windows\Replay Media Catcher

2009-01-16 11:39 . 2009-01-16 11:42 <DIR> d-------- c:\program files\Replay Media Catcher

2009-01-16 11:38 . 2009-01-16 11:38 <DIR> d-------- c:\windows\Applian FLV Player

2009-01-16 11:38 . 2009-01-16 11:43 <DIR> d-------- c:\program files\FLV Player

2009-01-14 16:56 . 2008-08-19 18:08 1,435,272 --a------ c:\windows\system32\Flash8.ocx

2009-01-12 13:24 . 2009-01-12 13:25 <DIR> d-------- c:\documents and settings\Ronksi\Application Data\Super-Cow

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-01 23:02 --------- d-----w c:\documents and settings\Ronksi\Application Data\Skype

2009-02-01 21:03 --------- d-----w c:\documents and settings\Ronksi\Application Data\skypePM

2009-02-01 21:02 --------- d-----w c:\documents and settings\Ronksi\Application Data\VoozieMaker

2009-02-01 05:57 --------- d-----w c:\program files\a-squared Anti-Malware

2009-01-30 01:06 --------- d-----w c:\documents and settings\Ronksi\Application Data\ICQ

2009-01-29 10:33 --------- d-----w c:\documents and settings\Ronksi\Application Data\Any Video Converter

2009-01-28 23:39 --------- d-----w c:\program files\multiskype

2009-01-28 04:51 --------- d-----w c:\program files\Common Files\Skype

2009-01-28 04:51 --------- d-----w c:\documents and settings\All Users\Application Data\Skype

2009-01-28 04:51 --------- d-----r c:\program files\Skype

2009-01-28 00:12 --------- d-----w c:\documents and settings\All Users\Application Data\Make A Voozie

2009-01-27 20:45 --------- d-----w c:\program files\IncrediGames

2009-01-27 20:36 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-01-23 02:35 --------- d-----w c:\program files\Winamp

2009-01-22 20:24 --------- d-----w c:\program files\Java

2009-01-19 01:10 --------- d-----w c:\program files\Favorite-Games

2009-01-15 01:37 --------- d--h--w c:\program files\InstallShield Installation Information

2009-01-13 07:00 --------- d-----w c:\program files\SA Dictionary 2004 Datacenter

2009-01-12 21:56 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP

2009-01-12 21:23 --------- d-----w c:\program files\Oberon Media

2009-01-12 02:56 --------- d-----w c:\documents and settings\Ronksi\Application Data\Flood Light Games

2009-01-12 02:56 --------- d-----w c:\documents and settings\All Users\Application Data\Flood Light Games

2009-01-09 21:45 --------- d-----w c:\documents and settings\Ronksi\Application Data\Winamp

2008-12-28 02:30 --------- d-----w c:\program files\Common Files\BOONTY Shared

2008-12-16 01:56 --------- d-----w c:\program files\ESET

2008-12-12 02:41 --------- d-----w c:\documents and settings\Ronksi\Application Data\Nokia

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 1961984]

"Magentic"="c:\progra~1\Magentic\bin\Magentic.exe" [2008-05-19 832824]

"BitComet"="c:\program files\BitComet\BitComet.exe" [2005-09-07 2600960]

"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 1232896]

"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 1079808]

"ICQ"="c:\program files\ICQ6\ICQ.exe" [2008-09-01 173304]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"msnmsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-12-13 7323648]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-12-13 86016]

"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]

"Make A Voozie"="c:\documents and settings\All Users\Application Data\Make A Voozie\VoozieMaker.exe" [2008-02-20 64000]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"VMSnap3"="c:\windows\VMSnap3.EXE" [2006-08-30 49152]

"Domino"="c:\windows\Domino.EXE" [2006-06-28 49152]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 1443072]

"a-squared"="c:\program files\a-squared Anti-Malware\a2guard.exe" [2009-01-27 2784912]

"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-04-01 36352]

"nwiz"="nwiz.exe" [2005-12-13 c:\windows\system32\nwiz.exe]

"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]

"RTHDCPL"="RTHDCPL.EXE" [2006-06-27 c:\windows\RTHDCPL.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [12/13/2004 5:44:06 PM 29696]

FlexType 2K.lnk - c:\windows\Datecs\Flex2K.exe [8/8/2008 10:32:40 PM 145920]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]

2001-12-20 22:34 24576 c:\program files\AlienGUIse\fastload.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinSpooler32]

@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\BitComet\\BitComet.exe"=

"c:\\Program Files\\ICQ6\\ICQ.exe"=

"c:\\Program Files\\Magentic\\bin\\magentic_install.exe"=

"c:\\Program Files\\Magentic\\bin\\Magentic.exe"=

"c:\\Program Files\\Magentic\\bin\\MgImp.exe"=

"c:\\Program Files\\Magentic\\bin\\MgApp.exe"=

"c:\\WINDOWS\\ServicePackFiles\\i386\\tcptest.exe"=

"c:\\WINDOWS\\system32\\mmc.exe"=

"c:\\Program Files\\SopCast\\SopCast.exe"=

"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"c:\\Program Files\\MSN Messenger\\livecall.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [12/21/2007 7:21:56 AM 33800]

R3 vmfilter303;vmfilter303;c:\windows\system32\drivers\vmfilter303.sys [6/9/2008 9:33:20 PM 428160]

R4 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [12/21/2007 7:21:16 AM 468224]

R4 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [8/3/2004 3:56:58 PM 14336]

S4 WinSpooler32;Windows System Memory Manager;"c:\windows\system\smsc32.exe" --> c:\windows\system\smsc32.exe [?]

.

Contents of the 'Scheduled Tasks' folder

2009-02-01 c:\windows\Tasks\User_Feed_Synchronization-{1A65FC88-7467-47E1-B9DD-5D27F270F940}.job

- c:\windows\system32\msfeedssync.exe [2007-08-13 18:36]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://mystart.magentic.com/english/

uInternet Connection Wizard,ShellNext = iexplore

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

TCP: {22A2CADE-1F4B-4E19-BC3F-24888EE7672D} = 84.238.220.1

DPF: {6CE31B8D-8340-4DBD-B78E-BF59620924DC} - hxxp://www.quest3d.com/webplugin/download/quest3dactivex2.cab

DPF: {EAC139A9-D22D-4C29-8D1C-252BE63750F9} - hxxp://piclens.com/shared/plinstll.cab

FF - ProfilePath - c:\documents and settings\Ronksi\Application Data\Mozilla\Firefox\Profiles\tb3x7mbd.default\

FF - prefs.js: browser.search.selectedEngine - Google.bg

FF - prefs.js: browser.startup.homepage - hxxp://mystart.magentic.com/

FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-01 15:02:15

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(692)

c:\program files\AlienGUIse\fastload.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\a-squared Anti-Malware\a2service.exe

c:\windows\ATKKBService.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\nvsvc32.exe

c:\windows\system32\wscntfy.exe

c:\program files\PC Connectivity Solution\ServiceLayer.exe

c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe

c:\program files\PC Connectivity Solution\Transports\NclIrSrv.exe

c:\program files\Common Files\Nokia\MPAPI\MPAPI3s.exe

c:\program files\AlienGUIse\AlienwareDock\ObjectDock.exe

c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe

c:\program files\MSN Messenger\usnsvc.exe

.

**************************************************************************

.

Completion time: 2009-02-01 15:04:38 - machine was rebooted

ComboFix-quarantined-files.txt 2009-02-01 23:04:17

ComboFix2.txt 2009-02-01 21:06:16

Pre-Run: 5,464,420,352 bytes free

Post-Run: 5,464,326,144 bytes free

208 --- E O F --- 2008-06-08 10:07:01

Malwarebytes' Anti-Malware 1.33

Database version: 1712

Windows 5.1.2600 Service Pack 3

2009-02-01 15:11:12

mbam-log-2009-02-01 (15-11-12).txt

Scan type: Quick Scan

Objects scanned: 50873

Time elapsed: 2 minute(s), 7 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 12

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 2

Files Infected: 17

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

C:\WINDOWS\RSM (Spyware.RealSpyMonitor) -> Quarantined and deleted successfully.

C:\Program Files\Real Spy Monitor (Spyware.RealSpyMonitor) -> Quarantined and deleted successfully.

Files Infected:

C:\WINDOWS\RSM\1.jpg (Spyware.RealSpyMonitor) -> Quarantined and deleted successfully.

C:\WINDOWS\RSM\10.jpg (Spyware.RealSpyMonitor) -> Quarantined and deleted successfully.

C:\WINDOWS\RSM\11.jpg (Spyware.RealSpyMonitor) -> Quarantined and deleted successfully.

C:\WINDOWS\RSM\12.jpg (Spyware.RealSpyMonitor) -> Quarantined and deleted successfully.

C:\WINDOWS\RSM\13.jpg (Spyware.RealSpyMonitor) -> Quarantined and deleted successfully.

C:\WINDOWS\RSM\2.jpg (Spyware.RealSpyMonitor) -> Quarantined and deleted successfully.

C:\WINDOWS\RSM\3.jpg (Spyware.RealSpyMonitor) -> Quarantined and deleted successfully.

C:\WINDOWS\RSM\4.jpg (Spyware.RealSpyMonitor) -> Quarantined and deleted successfully.

C:\WINDOWS\RSM\5.jpg (Spyware.RealSpyMonitor) -> Quarantined and deleted successfully.

C:\WINDOWS\RSM\6.jpg (Spyware.RealSpyMonitor) -> Quarantined and deleted successfully.

C:\WINDOWS\RSM\7.jpg (Spyware.RealSpyMonitor) -> Quarantined and deleted successfully.

C:\WINDOWS\RSM\8.jpg (Spyware.RealSpyMonitor) -> Quarantined and deleted successfully.

C:\WINDOWS\RSM\9.jpg (Spyware.RealSpyMonitor) -> Quarantined and deleted successfully.

C:\WINDOWS\RSM\Filelog.txt (Spyware.RealSpyMonitor) -> Quarantined and deleted successfully.

C:\WINDOWS\RSM\Photo.txt (Spyware.RealSpyMonitor) -> Quarantined and deleted successfully.

C:\WINDOWS\RSM\ProgramEnd.txt (Spyware.RealSpyMonitor) -> Quarantined and deleted successfully.

C:\WINDOWS\RSM\Title.txt (Spyware.RealSpyMonitor) -> Quarantined and deleted successfully.

1 февруари 200917 г.

Ужас...

1. Изтеглете ATF-Cleaner
2. Запишете я на произволно място.
3. Стартирайте файла (не е нужна инсталация) . Ще са необходими администраторски права (особено при Windows Vista).
4. Сложете отметки на всички редове, освен на Prefetch и изберете Empty Selected.

След това:

Отвори Notepad и въведи следното:

Killall::


Rootkit::

c:\windows\system\smsc32.exe


Driver::

WinSpooler32


Registry::

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinSpooler32]

След, което знаеш процедурата.

Накрая следвай тези инструкции:

http://www.eset.bg/forum/viewtopic.php?f=5...e19f74679e71bdc

1 февруари 200917 г.

ComboFix 09-01-31.01 - Ronksi 2009-02-01 15:49:11.4 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.1023.607 [GMT -8:00]

Running from: c:\documents and settings\Ronksi\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Ronksi\Desktop\CFScript.txt

AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated)

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system\smsc32.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_WINSPOOLER32

-------\Service_WinSpooler32

((((((((((((((((((((((((( Files Created from 2009-01-01 to 2009-02-01 )))))))))))))))))))))))))))))))

.

2009-02-01 15:07 . 2009-02-01 15:07 <DIR> d-------- c:\documents and settings\Ronksi\Application Data\Malwarebytes

2009-02-01 15:06 . 2009-02-01 15:12 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-02-01 15:06 . 2009-02-01 15:06 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-02-01 15:06 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-02-01 15:06 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys